Docker: awekho amachibi amakheli achazwe ngaphambili asele phakathi nesikhathi se-VPN

Ukwehluleka kucacile: i-Docker ayikwazi ukuthola i-subnet ezenzakalelayo eyamukelekayo yenethiwekhi entsha yebhuloho. Lokhu akusho ukuthi amakheli omshini aphelile, futhi akusho ukuthi i-VPN yephukile. Imibuzo emibili inquma ukuxilongwa: yimaphi amabhulokhi angabangeneleki i-daemon engawabona, futhi yimaphi kuwo umabi wayo awayishiyayo kule mvelo. Zisebenzise ngokulandelana, ngoba umbuzo wesibili awunansi uma umbuzo wokuqala ungakaphendulwa.

Qinisekisa ukuthi kwahluleka ini ngaphambi kokushintsha noma yini

Sebenzisa izinyathelo ezingezansi kusuka kusibungu esiqhuba i-daemon. Ishidi elikhuluma nomongo okude lichaza umshini ohlukile, futhi lelo phutha lodwa lingachitha ihora.

Ngasikhathi sinye bhala inguqulo ye-Engine kuthikithi. Wonke ama-heuristic asensaleni yalo mhlahlandlela axhomekeke enguqulweni, futhi isimangalo esingenayo inguqulo iyindaba nje.

Bala ukwabiwa osele unakho

Bhala uhlu lwamanethiwekhi, bese uhlola lawo abalulekile: docker network ls, bese docker network inspect NETWORK_NAME. Funda ama-subnet abo e-IPAM kanye namakhonteyina axhunywe kwelinye nelinye. Amaphrojekthi amaningi e-Compose asebenzisa amabhulokhi amaningi kunalokho okushiwo inani lamakhonteyina awo, ngoba iphrojekthi ngayinye ijwayele ukwakha inethiwekhi yayo ezenzakalelayo. Ikhonteyina elimisiwe alikhululi ukwabiwa kwenethiwekhi yalo.

Hlola futhi ukumiswa kwechibi, ngoba ichibi elizenzakalelayo linobubanzi besisekelo nosayizi we-prefix inethiwekhi ngayinye. Ukwabiwa okukhulu ngenethiwekhi ngayinye kuqeda amabhulokhi atholakalayo ngokushesha, futhi lokho kuyiqiniso lomthamo, hhayi inkinga yomzila.

Bhala inombolo. Yiyo ilayini lesisekelo elikutshela ukuthi ushintsho olulandelayo lusizile yini.

Qhathanisa umbono we-daemon ngemizila

I-VPN ingaba nomthelela ekukhethweni kwabangeneleki, kodwa ukuqaliswa okuqondile yikho okunqumayo ukuthi kanjani. Ku-Moby 28.2.2 ku-Linux, i-InferReservedNetworks iqoqa amakheli eseva yamagama kanye neminye imizila ye-IPv4 on-link, futhi ayigcini nje yonke imizila evela kuzo zonke amathebula. Imizila yokuxhumana eqoqiwe iphinde isuse ikheli lendawo okulingwa kuyo elingacacisiwe, ngakho umzila owodwa we-0.0.0.0/1 awugcini wonke amakheli. Enye i-prefix ebanzi ye-on-link, njenge-128.0.0.0/1, ingasika izigaba zabangeneleki ezijwayelekile u-172 no-192.

Qhathanisa i-ip -4 route show table all ngaphambi nangemva kokuxhumana kwe-VPN, kusibungu se-daemon. Umehluko uwubufakazi, futhi inguqulo ingububanzi besimangalo.

Ungawenzi ama-heuristic wenguqulo eyodwa abe ngawazo zonke izinguqulo. Yileyo ndlela impendulo yeforamu ephenduka ushintsho lwenqubomgomo.

Khetha ukulungisa okuncane okusebenzayo

Uma inethiwekhi eqinisekisiwe engasetshenziswa igcina ibhulokhi oludingayo, hlela ukuhoxiswa kwayo okuhlosiwe nomnikazi esikhundleni sokusika kabanzi. Enethiwekhi entsha, i-subnet engasetshenziswa ehlolwe ngokucacile igwema ngokuphelele ukuncika ekukhethweni okuzenzakalelayo. Leyo subnet kusamele igweme izindawo zangempela ze-Docker, LAN kanye ne-VPN edingekayo, ngoba okwangasese akusho ukuphepha. Ukuhambisa i-prefix yaphesheya kwangempela kungashintshanisa iphutha lokwabiwa ngokufinyelela okwephukile.

Ukushintsha i-default-address-pools kuyinqubomgomo ebanzi mayelana nokwabiwa kwesikhathi esizayo. Khetha isisekelo esingaphikisani nosayizi owabiwe ofanele, kuhlanganise nokumiswa kwe-daemon okukhona, futhi uhlele umthelela wokuqala kabusha obhaliwe. Amanethiwekhi akhona awashintshwa izinombolo ngasese.

Ungakunqamuki ukuthunyelwa kwemizila yenkampani ukuze ukwabiwa kuphumelele. Uhlelo olucacile lwamakheli ngokuvamile luxazulula inkinga yasendaweni ngaphandle kokunciphisa inqubomgomo eyisibopho.

Yamukela ukwabiwa kanye nokuhambisa ngokwehlukana

Ngemva koshintsho, hlola i-subnet eyakhiwe ngempela yi-Docker futhi uhlole ukuncika kohlelo lokusebenza kwi-VPN nakwasendaweni. Ukwabiwa okuphumelelayo nokuhambisa okulungile ngesikhathi sokusebenza kuyizivivinyo ezimbili ezihlukene zokwamukela, futhi ukuphumelela kwesokuqala akubona ubufakazi besibili. Uma uhlelo lokusebenza lungakwazi ukufinyelela isisetshenziswa esingemva kwethuneli, unenkinga yokuhambisa eyayifihlwa iphutha lechibi. Bhala imiphumela yomibili kuthikithi.

Gcina umehluko wemizila kanye nenani lechibi kanye nerekhodi loshintsho, ngoba ukubuyekezwa okulandelayo kweklayenti le-VPN kungashintsha okokuqala ngaphandle kokuthinta i-Docker.

Umhlahlandlela uphelele lapho omunye umuntu ekwazi ukuphinda lezo zivivinyo ezimbili futhi athole impendulo efanayo.