Ikhiqizo le-VPN lihlala ngemuva kokwakhiwa kabusha kwe-container kuphela uma uyifaka nge-mount
Ifayela elihlelwe ngaphakathi kwe-container esebenzayo lihlala kusendlalelo esinyamalalayo. Qhathanisa bind mounts, volumes namasecret, bese wakha kabusha futhi uqinisekise izinto ezine.
Uhlela ikhiqizo le-WireGuard ngaphakathi kwe-container esebenzayo, liyasebenza, futhi ukubuyekezwa kwe-image okulandelayo kuyalisusa. Akukho okwakulungiswe ngendlela engalungile. Ifayela lalihlala kusendlalelo se-container esibhalelekayo, esikhona kuphela kuleso sibonelo se-container. Ukuqhathanisa okubalulekile akukona ukuthi isiphi isisetshenziswa okufanele sisetshenziswe, kodwa ukuthi yikuphi ukufaka okukhangiswa ukusetshenziswa kwakho. Konke okukuhlele ngesandla kungukufaka okungakwazi ukusetshenziswa.
Izinhlobo ezimbili zesimo, esisodwa siyalahlwa
I-container inesendlalelo esibhalelekayo sezinguquko ezenziwa ngesikhathi sokusebenza, futhi leso sendlalelo siyalahlwa lapho i-container ishintshwa. Akusona isitoreji sekhiqizo futhi akusona ikhophi yokulondoloza. I-image kanye nokufaka okukhangisiwe yikho konke ukuchazwa kwalokho okusebenzayo.
Buza ukuthi yikuphi amafayela e-VPN akho ayizinto zokufaka ezikhalisiwe futhi yikuphi okuyizingozi:
docker diff wg-vpn
docker inspect --format '{{json .Mounts}}' wg-vpnI-diff ibala lokho okushintshile kusendlalelo esibhalelekayo, futhi yilokho kanye okuqoqo lwezinto ezizonyamalala. Uhlu lwe-mount lukhombisa lokho okusalayo. Ukuqhathanisa kokubili kuphendula umbuzo ngaphambi kokuba ulahlekelwe yilutho.
Bind mount, i-volume enegama noma i-secret: yikuphi okuvikelwa yikho ngakunye
Zontathu zingagcina iphrofayili ye-VPN, futhi zihluka ngokuthi ubani angayifunda kanye nokuthi kwenzekani lapho kushintshwa.
| Mechanism | Survives recreation | Who can read it |
|---|---|---|
| Writable layer | No | Anyone with container access, until it is gone |
| Bind mount | Yes, while the host path exists | Whatever the host permissions allow |
| Named volume | Yes, until the volume is removed | Managed by the runtime |
| Secret | Yes, as a declared input | The container process, by design |
I-bind mount ixhumanisa indlela ye-host, ngakho ifayela livikelwe ngendlela leyo ndlela evikelwe ngayo futhi libonakala ngendlela izimvume ze-host ezivumela ngayo. I-volume enegama ilawulwa yi-runtime futhi ihlala ngemuva kokususwa kwe-container, okwenza kube ukukhetha okuvikelekile okuzenzakalelayo kwesimo esiphethwe ukusetshenziswa. Indlela ye-secret yenzelwe into ongayifuni ku-image noma ku-environment variable.
Ungathathi yonke i-environment variable nayo yonke ifayela le-host njengokuvikelwa okulinganayo, ngoba akunjalo.
Ukuhlela ngaphakathi kwe-container yiwo umgibe
Umgibe akusona isisetshenziswa, kodwa uhlangothi lokuhlela. Ushintsho olwenziwe ngaphakathi kwe-container esebenzayo alubonakali ekusetshenzisweni, ngakho ukwakhiwa kabusha okulandelayo kulubuyisela ngokuthula futhi uphawu lubonakala njengokuhlehla ku-image. Uma kufanele wenze ushintsho lapho ukuze uhlole, kopisha ngokushesha ngaphandle futhi ulubeke ekufakeni okukhangisiwe. Bese wakha kabusha ukuze ufakazele ukuthi ukusetshenziswa kukukhiqiza kabusha.
Iphrofayili ingathwala okhiye bangasese kanye nempahla ye-akhawunti, okwenza ikhophi yalelo fayela ibe umsebenzi wokuphatha imfihlo esikhundleni sokukopisha ifayela. Gcina ubunikazi nokufinyelela kokufunda kukhawulelwe kunqubo yangempela ye-container, esikhundleni sokwandisa imikhombandlela ye-host ukuze iphutha lemvume linyamalale.
Lokho kwandisa yikho okwenza ukunethezeka ku-container kube ukuvezwa kwe-host.
Yakha kabusha ngenhloso, bese uqinisekisa izinto ezine
Bhala inguqulo ye-image, idivayisi namakhono adingekayo, ukuxhumana kwenethiwekhi kanye nokufaka okuhlala njalo. Uhlu lwedivayisi namakhono lubaluleke kakhulu ku-container ye-VPN, ngoba umhubhe udinga idivayisi yenethiwekhi kanye nelungelo lokuyihlela.
Qinisekisa ukuthi yisiphi isimo sokusebenza esikhiqiziwe okufanele sakhiwe kabusha esikhundleni sokugcinwa. Okhiye akhiqizwa umhubhe ekuqaleni kokokuqala bangumbuso, futhi isinqumo sokubagcina noma ukuwabuyisela kabusha sisho okuthile kuyo yonke i-peer eyazi ukhiye womphakathi wakudala.
Ngemuva kokwakhiwa kabusha okulawulwayo, qinisekisa ubunikazi, umzila, i-DNS kanye nokuvinjelwa kokwehluleka okudingekayo. Inqubo eqala ngaphandle kwamaphutha ayifakazeli lulodwa kulezi zine. Kuyihlole ngesikhathi umhubhe usebenza futhi futhi ngemuva kokuwumisa, ngoba ukuvinjelwa kokwehluleka kuzibonakalisa kuphela lapho umhubhe unyamalala.
Gcina ikhophi yokubuyisela ngaphandle kwe-container
Gcina ikhophi yokubuyisela ephila ngokuzimela kwi-container, futhi uhlole ukuyibuyisela ngenqubo ebhaliwe. Ikhophi yokulondoloza yephrofayili ye-VPN engahloliwe iyithemba, ikakhulukazi lapho indlela yokubuyisela ihlanganisa izimvume ezidingwa inqubo ye-container.
Uma i-container ephethe i-VPN ishintshwa, xhumanisa izinhlelo ezabelana ngesitaki sayo senethiwekhi phakathi komjikelezo wokuphila osekelwa yi-runtime.
Lokho kuxhumanisa kumehluko phakathi kokuqala kabusha nokuphazamiseka. Ukusetshenziswa kufanele kuchaze ukuthi ikhiqizo livela kuphi, futhi imibhalo ye-volume iyindawo yokuhlola ukuthi i-runtime igcina ini ngempela.