I-OpenVPN ku-Docker ayikwazi ukuvula i-/dev/net/tun: yini engekho

Izithombe ze-container zingaqukatha wonke amafayela e-OpenVPN binary kanye nokucushwa ewadingayo futhi zihluleke ocingweni lokuqala lwenethiwekhi. Iphutha lisho i-/dev/net/tun ngoba uhlelo lwacela i-TUN interface ku-kernel futhi i-container yayingenayo i-node yedivayisi noma ikhono lokuyakha. Lezi yizimvume ezimbili ezihlukene, futhi ukulungisa enye kushiya enye endaweni eyayikuyo ngqo.

Ukuzihlukanisa kudinga umyalo owodwa kuleyo naleyo. Umlayezo wephutha ngemva kwalokho ukutshela ukuthi wawumi kuphi umngcele ngempela.

I-node yedivayisi nekhono yiminyango emibili

I-node yedivayisi iyinto yesistimu yamafayela, ngakho i-container kufanele iyibone endaweni yayo yamagama yokufaka. Ikhono liyimvume, ngakho inqubo idinga i-CAP_NET_ADMIN endaweni yamagama lapho i-interface izokwakhiwa khona. Ukudlulisa idivayisi ngaphandle kwekhono kukunika i-node evulayo kanye ne-ioctl ehlulekayo. Ukunikeza ikhono ngaphandle kwedivayisi kushiya uhlelo lungakwazi ukuvula lutho, yingakho kokubili kuvame ukuvela ndawonye ezibonelweni.

Isilungiselelo se-devices se-Docker sihlanganisa idivayisi yomsingathi ku-container, kuyilapho i-cap_add ilungisa isethi yamakhono. I-bind mount yendlela efanayo ibeka ifayela emehlweni ngaphandle kokusebenzisa incazelo yokufinyelela idivayisi.

Phinda lokhu ngaphandle kwefayela le-Compose

Ngaphambi kokuhlela isevisi, qinisekisa ukuthi umsingathi unedivayisi nokuthi i-container engenalutho ingakha i-interface. Umyalo ongezansi mncane ngamabomu, futhi inhloso yawo kuphela ukuhlukanisa inkinga yomsingathi enkingeni ye-compose. Uma wehluleka, akukho shintsho lwe-compose oluzosiza.

ls -l /dev/net/tun
docker run --rm --cap-add NET_ADMIN --device /dev/net/tun:/dev/net/tun alpine sh -c 'apk add -q iproute2 && ip tuntap add dev tun9 mode tun && ip link show tun9'

I-node engekho kumsingathi isho ukuthi imojuli ye-tun ayitholakali, lokhu kuwukulungisa ohlangothini lomsingathi hhayi lwe-container. I-node ekhona kodwa engavuleki ngaphakathi kwe-container ikhomba ekufinyeleleni idivayisi, futhi umlayezo uzothi permission denied hhayi no such file. Ukulandelana kwalezi ziphambeko ezimbili iwukuxilongwa konke. Bhala phansi ukuthi yikuphi owakubonayo ngaphambi kokushintsha noma yiliphi ifulegi.

Amaphutha ngemva kwe-TUN yizinye izinkinga

Ngokushesha lapho i-interface ivela, ukwehluleka okulandelayo kunomnini ohlukile. Amaphutha okuqinisekisa isimo asho ukuthi ithuneli lifinyelele iseva futhi izifakazelo zenqatshiwe, ngakho izinguquko zamakhono ngeke zisize. Ithuneli elisungulwayo ngenkathi izinhlelo zisahluleka likhomba emizileni, ekudluliseni, ekuxazululeni i-DNS ngaphakathi kwe-container noma ekuhlelweni kwenethiwekhi kwe-container uqobo. Ngakunye kwalokhu kuwumbuzo ojwayelekile wenethiwekhi imvume ye-TUN engakwazi ukuwuphendula. Ukuphinda ukuhlolwa kwasekuqaleni ngemva kwakho konke ukushintsha kuvimbela ukwehluleka ukuhlangana kube umbono owodwa.

Ukukopa zonke izilungiselelo ezibonelweni ezisebenzayo yindlela ukulungisa okuncane okuba incazelo yesevisi engafundeki. Letha kuphela lezo okudinga ukusetshenziswa kwalokhu futhi bhala ukuthi kungani ngayinye ilapho.

Qinisekisa i-interface ngaphakathi kwe-container

Hlola i-interface nesethi yamakhono ngaphakathi kwe-container esebenzayo hhayi kumsingathi. Imiyalo engezansi ikhombisa i-node yedivayisi, uhlu lwamakhono nokuthi i-interface ingakhiwa yini nhlobo. Yisebenzise ku-container efanayo esebenzisa iklayenti, futhi ufake amathuluzi uma isithombe sincane.

ls -l /dev/net/tun
capsh --print | grep -i net_admin
ip link add dev tun9 type tun && ip link show tun9

Ikhono elikhona ku-bounding set kodwa elingekho ku-effective set liziphatha ngendlela ehlukile kunelokho elingakaze linikezwe, futhi i-capsh ibonisa kokubili. Uma i-node ikhona nekhono likhona kodwa ukwakhiwa kusahluleka, indawo yokusebenza iphoqa okunye, njengephrofayela ye-seccomp noma inqubomgomo ye-AppArmor evimbela umsebenzi. Lowo umngcele wesithathu, obhalwa yindawo yokusebenza hhayi uhlelo.

Bhala amafulegi e-container, isithombe kanye nephutha eliqondile lomzamo ngamunye. Umuntu olandelayo ofunda lelo nothi uzokwazi ukuthi yimuphi umnyango owawuvaliwe ngaphandle kokuphinda uphenyo lonke.