Lungisa ithrafikhi ye-Docker ne-WSL engayinaki i-VPN yomsingathi

Ngalentwasahlobo ngichithe ingxenye enkulu yekusasa ngilandela ikhonteyina eyayingakwazi ukuxazulula ngisho igama elilodwa langaphakathi, kuyilapho isiphequluli esiseduze sivula i-wiki ngaphandle kwesikhalo. Umhubhe wawuphezulu, isiphequluli sasikufakazela lokho, futhi ikhonteyina yayiku- esikhaleni segama lenethiwekhi esihlukile esinetafula lemizila ehlukile nesixazululi esihlukile. Okulandelayo uhlelo engiluhlola manje: kuqala amatafula emizila, okwesibili ukuxazululwa kwamagama, okwesithathu ukudlulisela futhi ekugcineni ipulatifomu yomsingathi. Ma ekuqaleni kwesinyathelo sokuqala esivele sihlulekile, ngoba ukwengeza imithetho phansi kusitaki kufihla umngcele esikhundleni sokuwuhambisa.

Qhathanisa amatafula amathathu emizila ngaphambi kokushintsha umthetho

Ikhonteyina ebhulohweni elizenzakalelayo le-Docker inomzila owodwa wokuhlala obheke egcekeni le-docker0 futhi ayazi ukuthi i-tun0 ikhona. Umsingathi unayo i-tun0, imizila edonswe yi-VPN, futhi mhlawumbe nomthetho wenqubomgomo othumela ithrafikhi yokuhlola ngendlela ehlukile kunaleya oyilindele. I-WSL yengeza itafula lesithathu ngemuva kwesixhumi sayo esibonakalayo. Printa womathathu ngaphambi kokuhlela noma iyiphi.

Uma umzila okuwukuphela kwawo wekhonteyina uwubhuloho futhi i-tun0 ingaveli neze esikhaleni sayo segama, akukho lutho olungezansi oluzosiza: alukho ushintsho lweseva yegama olwakha umzila, futhi awukho umzila owakha ubunikazi bomhubhe ozokwamukelwa. Ukulandelana kubalulekile ngoba ukwehluleka kwe-DNS nokwehluleka komzila kubonakala kufana ngaphakathi kwe-shell.

Qondisa isixazululi emhubheni hhayi kwesinye esivamile

Kumsingathi, resolvectl status ibala amaseva e-DNS ngesixhumanisi ngasinye, futhi readlink -f /etc/resolv.conf ikutshela ukuthi ifayela liyi-stub ye-systemd, ifayela le-NetworkManager, noma into ebhalwe kabusha yiklayenti yomhlinzeki. Ngaphakathi kwekhonteyina kunethiwekhi echazwe umsebenzisi, /etc/resolv.conf ibiza 127.0.0.11, isixazululi esakhelwe ngaphakathi se-Docker, esidlulisela ku-upstream okwakuhlelwe i-daemon nayo. Ikhonteyina ebhulohweni elizenzakalelayo yona yathola ikhophi yefayela lomsingathi ngenkathi yenziwa, futhi iyigcina.

Leyo khophi iyisizathu sokuthi umhubhe okhuphuka ngemuva kokuqala kwekhonteyina ushiye ikhonteyina ibuza i-upstream endala. Noma dlulisa isixazululi se-VPN ngokusobala ngokuthi docker run --dns 10.8.0.53, noma setha "dns": ["10.8.0.53"] ku- /etc/docker/daemon.json bese uqala kabusha i-daemon, noma wakhe kabusha ikhonteyina uma umhubhe usuphezulu. Ukwakha kabusha ngokuvamile kushibhe kunokuxazulula isixazululi esasilungile ehoreni eledlule.

Ukufaka isixazululi esivamile ukulungisa okugcina uphawu. Kuxazulula i-inthanethi kodwa kwehluleka kuzo zonke izindawo eziyingasese, futhi kungadlula ngokuthula ekuhlungwini okwenzelwa umhubhe. Uma uzama ukubhala ngaphakathi kwe- /etc/resolv.conf yekhonteyina esebenzayo, lindela Device or resource busy: i-Docker yenza i-bind-mount yalelo fayela, ngakho ukuhlela kudinga kuqala ukukhulula. Ukusetha --dns ngesikhathi sokwakha ukulandelana okusinda ekuqaliseni kabusha.

Dlulisela futhi uhumushe uma amakhonteyina eboleka umhubhe

Ngebhuloho elizenzakalelayo, umsingathi ungumhambisi phakathi kwe-docker0 ne-tun0, futhi ngokwezinto ezejwayelekile awenzi msebenzi womabili. Vula ukudlulisela futhi uhumushe ikheli lomthombo ukuze iqembu elibambisene libone ikheli lomhubhe lomsingathi esikhundleni saleli elingenayo indlela yokubuyela (faka i-tun0 esikhundleni segama iklayenti lakho elilipa indlela yokuxhumana):

sysctl -w net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
iptables -A FORWARD -i docker0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o docker0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Imithetho ye-FORWARD ibalulekile kumasingathi inqubomgomo yawo yokudlulisela iyi-DROP. I-Docker ifaka imigqa yayo, ngakho hlola ngephakethe esikhundleni sokufunda iptables -S: kusuka kukhonteyina, ip route get 10.8.0.20 kufanele ibize igceke lebhuloho, futhi nc -vz 10.8.0.20 443 kufanele ixhumane noma isikhathi siphele emhubheni hhayi kusixazululi.

Ngaphandle kwe-MASQUERADE iqembu elibambisene lidinga umzila wokubuyela ku-172.17.0.0/16, okuyinto iningi lama-VPN okufinyelela kude elingakudonsi. Yilapha futhi lapho iklayenti elisekelwe kunqubomgomo liphula uhlelo: uma libamba kuphela ithrafikhi yama-UID noma ama-cgroups athile, imithetho yakho yokudlulisela ayilokothi ibone iphakethe ngaphakathi komhubhe, futhi ukulungiswa kusenqubomgomo yomzila yeklayenti hhayi ku-iptables. Imithetho engezwe ngesandla iyanyamalala ekuqaliseni kabusha, ngakho yibeke ku-systemd unit noma etafuleni le-netfilter-persistent bese uphinda uhlole ngemuva kokuqalisa kabusha, ngoba umhubhe okhuphuka sekwephuzile ungazikhukhula.

Faka umhubhe ngaphakathi kwekhonteyina uma inhloso kuwukwehlukanisa

Uma ikhonteyina elilodwa kufanele liphume ngokusebenzisa inodi ethile, sebenzisa iklayenti kuleyo khonteyina. Lidinga --cap-add NET_ADMIN ne- --device /dev/net/tun, bese liba ne-tun0 yalo, imizila kanye nodonga lomlilo. Uma amanye amakhonteyina edlula kulo, lidinga futhi ukudlulisela nomthetho we-MASQUERADE ngaphakathi kwekhonteyina, futhi lawo maqembu adinga umzila ocacile noma i-proxy ekhomba kulo; ibhuloho elizenzakalelayo le-Docker aliwengezi lowo mzila kuwe.

Inethiwekhi yomsingathi, docker run --network host, inguqulo eshibhile: ikhonteyina ijoyina isikhala segama semsingathi futhi ibona imizila yomhubhe ngqo. Iphinde ilahle ukwehlukanisa kwenethiwekhi, imema ukungqubuzana kwamachweba, futhi empeleni iyinketho ye-Linux. Ichweba elishicilelwe aliyona indawo yalo. -p 8080:80 yenza isevisi ifinyeleleke kusuka kumsingathi; ayenzi amakheli angaphakathi e-10.x afinyeleleke ngaphakathi kwekhonteyina, futhi ukuhlanganisa kokubili iyona ndlela inkinga yomzila ephenduka ngayo ichweba ledathabhezi elivezile.

Hlukanisa ukwehluleka kwegama nesubneti elisibekelayo

Ibhuloho elizenzakalelayo le-Docker yi-172.17.0.0/16, futhi amachibi amaningi e-VPN yezinkampani asemkhakheni we-172.16.0.0/12. Uma umhubhe usunomkhakha lowo, ithrafikhi ehloselwe ikhonteyina ingahamba yangene emhubheni esikhundleni salokho. Amagama ayahluleka, iphutha libukeka njenge-DNS, futhi inkinga isemakhelini. Hlola indawo ekuyiwa kuyo, hhayi isixazululi: ip route get 172.17.0.5 kumsingathi, bese uqhathanisa isiqalo sebhuloho nechibi le-VPN kanye ne- docker network inspect bridge --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'.

Ukulungisa ukuhambisa esinye sezikhathi: kungaba ichibi lekheli elizenzakalelayo elihlukile le-Docker ku- daemon.json noma ichibi elihlukile kusihlanganisi. Ukwengeza esinye iseva yegama akwenzi lutho lapha, futhi ne- ssh -b ayikwenzi: ukubopha iklayenti endleleni yokuxhumana kushintsha ikheli lomthombo, hhayi umzila wendawo ekuyiwa kuyo okhomba emhubheni. Ukwahlukanisa umsebenzi ngokushesha: igama elixazululwa kumsingathi kodwa hhayi kukhonteyina inkinga yesixazululi, kuyilapho ukuxhumana kwe-IP okuqondile okulenga kukhonteyina kodwa okusebenza kumsingathi kuyinkinga yomzila noma yochungechunge lokudlulisela.

I-WSL ne-Docker Desktop azilandeli imithetho ye-Linux

Kumodi yayo ye-NAT ezenzakalelayo, i-WSL ihlezi ngemuva kwesixhumi sayo esibonakalayo futhi ayitholi imizila yangaphakathi noma izijobelelo ze-DNS ze-VPN ye-Windows, yingakho isiphequluli sisebenza futhi i- ping ngaphakathi kokusabalalisa ingenzi. Inethiwekhi yokubuka isibuko, etholakala kumakhiwo akamuva e-Windows 11, yabelana ngezixhumi zomsingathi esikhundleni salokho, kodwa kufanele inikwe amandla ku- .wslconfig futhi ukusabalalisa kuqaliswe kabusha nge- wsl --shutdown. Qinisekisa imodi esebenzayo nge- wslinfo --networking-mode ngaphambi kokusebenzisa ukulungisa, ngoba impendulo ye-NAT inephutha kumodi yesibuko futhi okuphambene nalokho.

I-Docker Desktop yengeza esinye isendlalelo. Amakhonteyina e-Linux ku-Windows ahlezi ngemuva kokuqaliswa kwe-NAT okwakubizwa ngokomlando ngokuthi i-vpnkit, futhi indlela yawo ihlukile kuneyomsingathi wendabuko we-Linux. Amakhonteyina e-Windows axhumana ngesishintshi esibonakalayo se-Hyper-V, futhi iklayenti lenkampani lingavimbela ithrafikhi evela kuleso sishintshi, ngakho amakhonteyina e-Linux kumshini ofanayo angafinyelela inethiwekhi kuyilapho amakhonteyina e-Windows engenalutho. Isishintshi sangaphandle esiboshwe kusixhumi somzimba siyisixazululo esivamile, futhi sishintsha ubunikazi benethiwekhi bekhonteyina ngezindlela inqubomgomo engase ingazivumeli.

Ngaphambi kokubhala omunye umthetho, hamba ngezendlalelo ezine ngokulandelana futhi ume lapho esinye sazo sinephutha:

• Ngaphakathi kwekhonteyina: ingabe i- ip route ifinyelela isiqalo esiyimfihlo, futhi ingabe i- /etc/resolv.conf ibiza i-upstream eyixazululayo?
• Kumsingathi: ingabe ukudlulisela kuvuliwe, i-NAT iboshwe endleleni yokuxhumana yomhubhe, futhi ingabe uchungechunge lokudlulisela lwamukela ibhuloho liya emhubheni?
• Kumaqembu: ingabe iyayazi indlela yokubuyela, noma uthembele ku-NAT ukufihla isubneti yekhonteyina?
• Kupulatifomu: ingabe i-WSL ikumodi ye-NAT noma yesibuko, futhi ikhonteyina i-Linux noma i-Windows?

Gijima kabusha isivivinyo ngasinye kukhonteyina noma ku-shell elisha. Inqubo yesikhathi eside enempendulo egciniwe noma uxhumano olusunguliwe izoqhubeka nokwehluleka ngemuva kokuthi ukucushwa kulungile, futhi lokho kwehluleka kubukeka njengokulungisa okungasebenzanga.