I-Docker container ayifinyeleleki nge-VPN? Qhathanisa ama-subnet

Ama-container aphendula ku-LAN yasehhovisi, bese eyeka ukuphendula ngesikhathi i-VPN yenkampani ixhuma. Akukho okushintshile ku-container: akukho ukuqala kabusha, akukho ukubuyekeza isithombe, akukho ukuhlela ukucushwa. Okushintshile yithebula yomzila we-host, lapho umzila owengezwe i-tunnel manje uhlanganisa ikheli elinikezwe i-Docker. Ngaphambi kokuhlela i-subnet noma ukucela ukukhululwa ku-VPN, beka izinhlelo zekheli zombili eceleni, ngoba ukulungisa kuthatha isikhathi esihluke kakhulu.

Funda umzila ngaphambi kokushintsha ukucushwa

Qala ngenethiwekhi eyakhiwe ngempela yi-Docker. Ibhlokhi ye-IPAM iwuhlelo lwekheli, futhi i-subnet iwumugqa obalulekile:

docker network inspect project_default --format '{{json .IPAM.Config}}'
# [{"Subnet":"172.18.0.0/16","Gateway":"172.18.0.1"}]

I-Compose yabela i-/16 kuyo yonke iphrojekthi entsha ngokuzenzakalela, ngakho amasevisi amabili angahlala ebangeni lamakheli angu-65,536. Lobu bubanzi yikho ukuhlangana kuvamile: i-/16 ekhethwe ngokungahleliwe yikhulu ngokwanele ukugwinya isayithi oyifinyelela nge-tunnel, futhi akekho oqaphelayo kuze kube i-tunnel iphakama.

Bese uqhathanisa ukukhethwa komzila wekheli elilodwa le-container, kanye lapho i-tunnel ivaliwe futhi kanye lapho ivuliwe:

ip route get 172.18.0.7
# 172.18.0.7 dev br-3f2a9c src 172.18.0.1

Izinhlobo ezimbili zezimpendulo ziholela ezindaweni ezihlukene. Uma okukhiphayo kusho i-tun0, i-wg0 noma elinye idivayisi ye-tunnel, isiqalo se-VPN sicacile okungenani njengomzila webhuloho futhi iphekithi ayifinyeleli ku-container nakancane. Uma isabiza ibhuloho, i-host ingafinyelela i-container, futhi iphutha lakho ukuhlunga, i-DNS noma indlela yokubuyela ehluleka ohlangothini olulodwa kuphela.

Kungani ukushayisana kwe-/16 kulula ukukuthola

I-Docker ithatha amanethiwekhi ebhuloho emachibini angasese, futhi ichibi elizenzakalelayo livela kubhlokhi ye-172.16.0.0/12 ngezingcezu ze-/16. Amanethiwekhi ezinkampani avame ukusebenzisa isikhala esifanayo sangasese, futhi i-VPN yokufinyelela kude ihambisa lezo ziqalo kuwo wonke iklayenti elixhumayo. Uma izinhlangothi zombili zikholelwa ukuthi zine-172.18.0.0/16, ithebula eyodwa yomzila ibamba izimangalo ezimbili eziphikisanayo.

Owinile unqunywa ubude besiqalo, hhayi ukulandelana kwemizila. I-tunnel ehambisa i-10.0.0.0/8 ayinqobi umzila webhuloho we-172.18.0.0/16, ngoba i-/8 ayicacile ngokwanele. I-tunnel ehambisa i-172.18.0.0/16, noma i-172.18.5.0/24 engaphakathi kwayo, iyanqoba. Yingakho ilaptop eyodwa isebenza kunethiwekhi yasehhovisi kodwa yehluleka ku-Wi-Fi yasehhotela nge-VPN efanayo: iklayenti lithola iziqalo ezihlukene.

Ithebula elifanayo ilawula uhlangothi olunye. I-container edinga i-host yangaphakathi ku-10.8.4.20 ithumela iphekithi esangweni layo lebhuloho, bese i-host iyihambisa iye ku-tunnel. Leyo ndlela ivamise ukusebenza ngoba i-host yenza i-NAT, kodwa yehluleka lapho uhlangothi lwenkampani lwamukela ikheli le-VPN lelaptop kuphela, noma lapho ukuhlunga komzila wokubuyela kulahla impendulo engalingani.

Qhathanisa ukulungisa okuthathu

Kunezindlela ezintathu kuphela zokuphuma, futhi ziyahluka ngokuthi ubani okufanele azigunyaze nokuthi yini ephukayo ngesikhathi usebenzisa enye.

Ukubola kabusha izinombolo ukuphela kokulungisa ongakuqeda ngaphandle kwethikithi, yingakho imibhalo eminingi ima lapho. Kushibhile kuphrojekthi entsha futhi kuyabiza lapho ithuluzi lokufuduka noma umucu wokuxhuma ogciniwe ukhomba ikheli elingokoqobo. Bala lezo zinkomba ngaphambi kokuhlela i-YAML, hhayi ngemva.

Ukukhululwa ku-tunnel yimpendulo ehlanzekile kakhulu lapho ukuhlangana kusebangeni inkampani yakho enalo ngempela. Futhi kunenkathi kakhulu, futhi akusizi kumuntu osebenza ngaphandle ongakwazi ukushintsha iphrofayela yeklayenti. Iphothi elishicilelwe noma i-proxy ehlanekezelayo encane igwema le mpikiswano: iklayenti likhuluma nekheli i-tunnel eseliyihambisa ngendlela efanele, futhi yilowo phothi kuphela okufanele ufinyeleleke.

Bophela ibanga ngenhloso

Kuyiphrojekthi eyodwa, memezela i-subnet kufayela le-compose ukuze iphrojekthi iyeke ukuthatha echibini elabiwe:

networks:
  default:
    ipam:
      config:
        - subnet: 10.201.7.0/24

Thatha lelo banga kurejista egcinwa ithimba lakho, hhayi esibonelweni osithole ngesikhathi usesha. Lihlole ngokumelene neziqalo ezihambiswa i-VPN, ama-LAN asekhaya abantu abasebenza kuwo, namanye amanethiwekhi e-container ku-host efanayo. Bese uhlela ukwakha kabusha, ngoba inethiwekhi ekhona igcina i-subnet yayo endala: i-docker compose down, bese i-up -d. I-docker network rm iyenqaba ngesikhathi iziphetho zixhunyiwe, futhi noma yikuphi okufakiwe kwe-ipv4_address kufayela kufanele kube ngaphakathi kwebanga elisha.

Kumanethiwekhi i-Docker ezakhela wona, setha ichibi le-daemon ku-/etc/docker/daemon.json:

{
  "default-address-pools": [
    { "base": "10.201.0.0/16", "size": 24 },
    { "base": "10.202.0.0/16", "size": 24 }
  ]
}

Ichibi lisebenza kumanethiwekhi akhiwe ngemva kokuqala kabusha kwe-daemon, futhi amabhuloho asevele ekhona agcina amakheli awo. Lokho kulula futhi kulula ukukukhohlwa, ngakho thatha iphrojekthi endala njengelisahlangana kuze kube umuntu wakha kabusha inethiwekhi yayo. I-idokhumenti yamanethiwekhi yenjini ye-Docker ichaza imithetho yokwaba uma udinga ukuvikela ichibi ekubuyekezweni.

Ibhuloho le-Linux ne-Docker Desktop kwehluleka ngendlela ehlukene

Ku-host ye-Linux, ama-container ahlala emabhulohweni asesikhaleni samagama se-host. Ithebula elilodwa linquma konke, ngakho ukuqhathanisa okungenhla yiyo yonke indaba: funda umzila webhuloho, funda umzila we-tunnel, bese ubona ukuthi yiphi enqobayo ngekheli langempela le-container.

I-Docker Desktop ibeka ama-container ngemva kwe-VM ene-NAT yayo. I-host ayinawo nakanye umzila oya ekhelini le-container; ifinyelela isevisi ngokusebenzisa iphothi elishicilelwe, ngokuvamile eliboshelwe ku-127.0.0.1. Ngakho iklayenti le-VPN lingaphula isevisi ngaphandle kokuhlangana kwe-subnet: kungaba ngokufaka umzila webanga langaphakathi le-VM noma ngokuvimba ithrafikhi ye-loopback ngesikhathi i-tunnel ixhunyiwe. Uma i-ip route get ku-host ibika ukuthi awukho umzila wekheli le-container, lokho kulindelekile hhayi iphutha.

Umphumela ongokoqobo ukuthi ubheka kuphi kuqala. Ku-Linux, qala kuthebula yomzila. Ku-Desktop, qala kuphothi elishicilelwe nasemithethweni ye-firewall yeklayenti le-VPN, bese uhlola ukuthi i-subnet yangaphakathi ye-VM iyashayisana yini nokuthile okuhambiswa i-tunnel.

Qinisekisa ngesikhathi i-tunnel ivuliwe

Xhuma kabusha i-VPN kabili ngaphambi kokuthi isilungisiwe, ngoba iphrofayela ehambisa imizila lapho ixhuma futhi iyihoxise lapho inqamuka ingase ibonakale ilungile ngemva komzamo wokuqala. Bese wenza izivivinyo okwenziwa ngempela yiklayenti:

1. I-ip route get kusukela ku-host, kusetshenziswa ikheli langempela le-container.
2. Isicelo esivela kwelinye i-container, ukufakazela ukuthi isevisi ngokwayo inempilo.
3. I-curl -sv http://127.0.0.1:8080/ kusukela kuklayenti ngesikhathi i-tunnel ivuliwe, bese i-traceroute -n iya ekhelini le-container kusukela emshinini oku-LAN.
4. I-sysctl net.ipv4.conf.all.rp_filter uma isicelo sifinyelela ku-host kodwa impendulo inyamalala.

Ekugcineni, bhala ibanga elikhethiwe kurejista efanayo oyisebenzise ukulikhetha, kanye nosuku kanye nephrojekthi engumnikazi walo. Ukuhlangana okulandelayo kuzovela kuphrojekthi okungekho oyibhalile, futhi ukuvikela kuphela ukuthi ibanga lalibekelwe ngenhloso hhayi ukuthi lathathwa ngokungahleliwe.