Docker: qondisa ikhonteyina eyodwa nge-VPN, bese ushiya enye iqondile

Nika umhubhe ikhonteyina yawo, vumela kuphela izinsizakalo ezikudingayo ukuthi zabelane leso sikhala samagama, bese ubheka okulandela umnikazi: amachweba, localhost, DNS.

Isiphathi esisodwa, imithwalo emibili yomsebenzi kanye nemfuneko ebahlukanisayo: iklayenti lokulanda okufanele liphume nge-VPN yezentengiselwano, kanye nesixhumi esibonakalayo sokuphatha okufanele siqhubeke sisebenzisa uxhumano lwesiphathi. Ukufaka iklayenti le-VPN kusiphathi kwehluleka imfuneko ngokushesha, ngoba lapho imithwalo yomibili yabelana ngokuphuma okukodwa. Iphethini esebenza ngempela ukuhambisa umhubhe uye kwikhonteyina yawo, bese uvumela kuphela imithwalo yomsebenzi ewudingayo ukuthi ijoyine isikhala samagama senethiwekhi yaleyo khonteyina. Konke okunye kugcina indlela ejwayelekile ye-Docker, futhi imininingwane elandelayo iyimiphumela yokuthi ubani ongumnikazi wesikhala samagama.

Kungani isikhala samagama esabiwe siguqula imithetho

Ikhonteyina ejoyina isikhala samagama somunye ayitholi isitaki sayo senethiwekhi. Ibona izingxenye ezifanayo, ithebula elifanayo lokuhambisa kanye ne-loopback efanayo njengekhonteyina ejoyine kuyo, futhi yikho kanye okwenza iphethini ibe wusizo: umthwalo womsebenzi uxazulula futhi uxhuma ngendlela ejwayelekile, kanti umhubhe ongaphansi ubamba ithrafikhi ngaphandle kokuthi uhlelo lwazi. Izindleko zukuthi sonke isilungiselelo senethiwekhi manje sinomnikazi oyedwa, futhi ikhonteyina ejoyinayo akuyona lowo mnikazi.

Lo mthetho wobunikazi uphendula imibuzo eminingi yokuhlela ngaphambi kokuthi ibuzwe. Uma isilungiselelo sihlala kusitaki senethiwekhi, singesekhonteyina eseceleni. Uma sichaza inqubo, sihlala nomthwalo womsebenzi.

I-loopback iyingxenye emangaza abantu. Ngaphakathi kwekhonteyina ejoyinayo, localhost ixazululwa iye ku-loopback yekhonteyina eseceleni, hhayi eyayo eyimfihlo, ngakho insizakalo ebopha ku-127.0.0.1 ilindele ukuhlukaniswa manje yabelana ngalelo kheli nekhonteyina yomhubhe.

Shicilela amachweba kukhonteyina ephethe isikhala samagama

Ukumephwa kwamachweba kungokomnikazi wesikhala samagama, ngisho noma inqubo elalelayo isebenza kwelinye ikhonteyina. Memezela ukumephwa kukhonteyina eseceleni, futhi uvumele umthwalo womsebenzi ugcine ukuhlela kwawo kwenqubo kungathinteki. Ukumephwa kwensizakalo ejoyinayo akukwazi ukusebenza, kungakhathaliseki ukuthi injini iyakwenqaba noma ikushaya indiva buthule kuye ngendlela ikhonteyina eqalwa ngayo, futhi yikho okwenza isixhumi esibonakalayo ebesifinyeleleka umzuzu owedlule sinyamalale ngokushesha lapho iphethini isetshenziswa.

services:
  gluetun:
    image: qmcgaw/gluetun
    cap_add: [NET_ADMIN]
    ports: ["8080:8080"]
  client-vpn:
    image: example/client
    network_mode: "service:gluetun"
  client-direct:
    image: example/client
    ports: ["8081:8080"]

Funda lelo blokhi njengezinqumo ezintathu hhayi izinsizakalo ezintathu. Ikhonteyina eseceleni ingumnikazi womhubhe kanye nechweba elishicilelwe; iklayenti elijoyinayo alimemezeli noma iyiphi inethiwekhi; iklayenti eliqondile ligcina ukumephwa kwalo kunethiwekhi ezenzakalelayo. Ikhono NET_ADMIN liyilo elivumela ikhonteyina eseceleni ukuthi idale izingxenye futhi iguqule izindlela, futhi yisizathu sokuthi le khonteyina idinga amalungelo amaningi kunemithwalo yomsebenzi eyisebenzelayo.

Insizakalo ehlala iqondile igcina inethiwekhi yayo

Umthwalo womsebenzi okungafanele udlule emhubheni ugcina ibhuloho elizenzakalelayo noma inethiwekhi yalo echazwe umsebenzisi, kanye nechweba layo elishicilelwe nokuphuma kwayo. Kuyalingeka ukuyixhuma kunethiwekhi yekhonteyina eseceleni ukuze amakhonteyina amabili akhulume ngegama, kodwa lelo nyathelo elilodwa lihambisa ithrafikhi yayo buthule iye emhubheni. Uma kufanele afinyelelane, yakha inethiwekhi ehlukile echazwe umsebenzisi, xhuma womabili kuyo, futhi ushiye ikhonteyina eseceleni iyiyo kuphela indlela yokuphuma.

Gcina imibuzo emibili ihlukene: yimaphi amakhonteyina angafinyelelana, futhi iyiphi ephuma kuphi. Ukuwahlanganisa yiyo indlela ejwayeleke kakhulu yokuthi lo mklamo uphinde ube i-VPN yesiphathi sonke.

Imethrikhi yokwehluleka yehora lokuqala

Iminyaka eminingi yokuqala yehluleka ngezindlela ezine, futhi ngayinye inesizathu esihlukile. Zihlole ngale ndlela yokulandelana, ngoba ezimbili zokuqala zichaza cishe wonke umbiko.

SymptomLikely cause
Web UI unreachable after the changePort mapping declared on the joining container instead of the sidecar
Both containers show the provider's exit addressThe direct service was attached to the sidecar network
Internal names stop resolvingResolver settings live on the host, not in the shared namespace
Health check fails but the app worksThe check probes localhost, which now means the sidecar

Umugqa wesine yiwo abantu abawuxilonga ngokungalungile njengephutha lohlelo. Ukuhlolwa okubhalwe ngokumelene ne-loopback yomthwalo womsebenzi uqobo manje kuhlola ikhonteyina yomhubhe, ngakho kuyahluleka noma kubika insizakalo engalungile neze.

Lapho igama lesiphathi elilodwa lidinga umhubhe

Ngezinye izikhathi umhubhe ogcwele muningi kakhulu: igama langaphakathi kufanele lidlule kwi-VPN yebhizinisi ngenkathi isokhethi yasendaweni noma uxhumano lwesibonisi luqhubeka lusebenza. Umhubhe ogcwele ngaphakathi kwekhonteyina uphula leyo ndlela kanye nakho konke okubhekiswe kusiphathi, ngakho qondisa kuphela isiqalo esikudingayo. Isembozo sokuhambisa esihlukanisiwe esizungeze iklayenti siyakwenza lokho, sithumela isiphathi esishiwo emhubheni futhi sishiye indlela yangaphambilini ingathinteki kukho konke okunye.

Khetha lokhu lapho udinga ukufinyelela insizakalo eyodwa kuphela futhi ungazami ukuhambisa yonke ithrafikhi yekhonteyina. Kuyithuluzi elihlukile kukhonteyina eseceleni futhi liphendula umbuzo ohlukile.

Qinisekisa, bese ukwenza ikwazi ukumelana nokuqalwa kabusha

Buza ikhonteyina ngayinye ukuthi ibonakala iphuma kukuphi ikheli. Leyo esemhubheni kufanele ishicilele ikheli lomhlinzeki futhi leyo eqondile iphumele ukuphuma kwesiphathi. Izimpendulo ezifanayo zisho ukuthi insizakalo eqondile yazuza isikhala samagama esingalungile noma i-VPN yezinga lesiphathi isabamba konke, futhi lokho kulungisa okubili kuyahluka. Phinda usebenzise ukuhlolwa ngemva kwakho konke ukuhlela kwe-compose, ngoba ibhlokhi yensizakalo eyodwa ekopishiwe yanele ukubuyisa inkinga.

Izinto ezintathu zivame ukuphuka kamuva. I-DNS ilandela umnikazi wesikhala samagama, ngakho izilungiselelo zesixazululi nesizinda sokusesha zingezekhonteyina eseceleni hhayi ezesiphathi. I-VPN enokudluliswa kwamachweba ishintsha ichweba layo lokulalela lapho ixhuma kabusha, ngakho ichweba elidluliswe umhlinzeki nechweba lokulalela ohlangothini lwekhonteyina kufanele kubhalwe emuva kukuhlela kweklayenti noma ekumephweni kwamachweba, ngokuvamile ngokubhala okuncane okufunda i-API yomhlinzeki. Futhi noma yikuphi ukuhlolwa okubhalwe ngokumelene ne-localhost manje kubuza ikhonteyina yomhubhe hhayi umthwalo womsebenzi.

Bhala iphethini phansi, kufaka phakathi ukuthi iyiphi ikhonteyina ephethe isikhala samagama nokuthi yimaphi amachweba angayo. Umuntu olandelayo uzofaka insizakalo, akopishe ibhlokhi engalungile futhi aphinde enze ukwehluleka kokuqala kulesi sihloko.

Izihloko ezihlobene