Kungani i-Docker container ingakwazi ukufinyelela amahost ngemuva kwe-VPN

I-container engakwazi ukufinyelela lutho ngemuva kwe-VPN yebhizinisi ivamise ukuhlala endaweni yamagama yenethiwekhi ehlukile kumhubhe. Imizila, amaseva e-DNS kanye nezimpawu zokuvikela zeklayenti lehost zingezestakhi sehost; i-container yenethiwekhi yebhuloho inesayo. Leli qiniso elilodwa lichaza iningi lemibiko efinyelela ithimba leplathifomu, futhi liyisizathu sokuthi «i-VPN iphukile» kanye «i-Docker idlula i-VPN» kungaba amaphutha ngasikhathi sinye. Ukuhlelwa okubili okuhluke kakhulu kucashile ngemuva komphawu owodwa, ngakho thola ukuthi eyiphi onawo ngaphambi kokushintsha noma yisiphi isilungiselelo.

Thola ukuthi umhubhe ungowendawo yamagama kabani

Ku-Docker Desktop ye-macOS noma ye-Windows, amacontainer asebenza ngaphakathi kwemishini ebonakalayo ye-Linux. Iklayenti le-VPN elifakwe kudeskithophu lakha umhubhe kusistimu yokusebenza yedeskithophu, futhi umshini obonakalayo awuwuboni neze. Akukho kulungiselelwa kwe-container okulungisa lokho, ngoba i-interface edingwa yi-container ayikho nhlobo endaweni yayo yamagama yenethiwekhi.

Ku-host ye-Linux umhubhe uhlala endaweni yamagama yehost, futhi amacontainer ebhuloho ngokuvamile awufinyelela ngethebula yemizila yehost ngokusebenzisa i-NAT yomthombo lapho kuphuma. Lapho leyo ndlela ihluleka, imbangela ngokuvamile akuyona imizila engekho, kodwa inqubomgomo yokudlulisela, ukuhlunga kwendlela ephambene noma isubneti edlulanayo. Qinisekisa ukuthi usesiphi sezwe ezimbili ngaphambi kokuqhubeka nokufunda:

docker info --format '{{.OperatingSystem}}'
docker run --rm --net=host alpine ip route | head -5
docker run --rm alpine ip route | head -5

Umehluko phakathi kwalawa mathebula emizila amabili yinkinga yonke kusikrini esisodwa. Uma umbono wehost unombhede womhubhe futhi umbono webhuloho ungenawo, ubheka ukuhlukaniswa kwezindawo zamagama, futhi konke okunye ukukhetha ukuthi uyiwela kanjani.

Inethiwekhi yehost iwukuhlolwa, hhayi umklamo

Ukugijima kwe-container ngenethiwekhi yehost, okuyi-Docker eyichaza njengokwabelana ngendawo yamagama yenethiwekhi yehost, kuyenza ilandele ngqo i-interface yomhubhe nemizila yawo. Uma isicelo esifanayo siphumelela ngemuva kwalokho, ithiyori yemizila iqinisekisiwe futhi ukwehluleka ukuhlukaniswa kwezindawo zamagama, hhayi izifakazelo, i-DNS noma umthetho wokufinyelela.

docker run --rm --net=host curl -sS -o /dev/null -w '%{http_code}\n' https://api.internal/health

Kugcine njengokuxilonga. Inethiwekhi yehost iyeka ukushicilela amachweba kanye neningi lokuhlukaniswa obukufuna kuyi-container, futhi ku-Docker Desktop «host» isho umshini obonakalayo, hhayi ideskithophu, ngakho impumelelo noma ukwehluleka lapho kungakudukisa uma ukhohlwa ukuthi ubukhuluma nayiphi ihost.

Idivayisi ye-tun kanye nezimvume eziza nayo

Iklayenti le-VPN ngaphakathi kwe-container lidinga idivayisi yomhubhe kanye nemvume yokuyilungiselela. Indlela evamile yokushesha i---privileged, enikeza yonke idivayisi futhi ixegise inqubomgomo yokuphepha kuyo yonke i-container. Lokho kungaphezulu kakhulu kwalokho okudingwa yilo msebenzi, futhi kunzima ukukuthethelela ekubuyekezweni.

sudo modprobe tun
docker run --rm -it --device /dev/net/tun --cap-add NET_ADMIN myvpn-client

Isimo esincane sihlela inodi eyodwa yedivayisi futhi sengeza kuphela amandla okuphatha inethiwekhi. Qala ukulayisha imojuli ku-host ukuze inodi ibe khona. Uma i-container iqala futhi iklayenti libika ukuthi alikwazi ukuvula idivayisi yomhubhe, hlola ukuhlelwa ngaphambi kokusola iphrofayili, ngoba lelo phutha ngokuvamile liwukusho ngqo.

Lokhu kuhlelwa kusho futhi ukuthi iklayenti ligijima nge-container ngayinye. Leyo iyimpendulo efanele lapho umthwalo womsebenzi ngamunye udinga umhubhe wawo, futhi iyimpendulo engafanele lapho ubufuna nje ukuthi umhubhe wehost ubonakale, okuyinto ithimba leplathifomu elicabanga ukuthi uyayenza.

I-NAT yebhuloho ishintsha umthombo obonwa yi-VPN

Ngebhuloho elizenzakalelayo, ukuhamba kwe-container okuphumayo kuhunyushwa kube ikheli lehost. Ngakho ngemuva kwe-VPN uhlangothi lwebhizinisi lubona ikheli lomhubhe wehost hhayi elokwe-container, imithetho yokufinyelela ngomthombo iziphatha sengathi ihost ithumele isicelo, futhi amacontainer amabili aba akuhlukaniseki kuseva ye-VPN.

I-macvlan noma i-ipvlan inikeza i-container ikheli le-LAN esikhundleni salokho, okusiza ukutholakala kwe-LAN futhi kwenza i-container ibonakale njengozakwethu esigabeni. Iphinde yeqe ngokuphelele umhubhe wehost, ngakho i-container enjalo ngeke ifinyelele iziqalo ze-VPN kuphela ngaphandle uma i-VPN ifinyeleleka futhi kusuka kuleyo LAN.

Zombili izimo zivumelekile; ziphendula izimfuno ezihlukile. Uma isimfuno sithi «le container kufanele ifinyelele isevisi ye-VPN kuphela», ukhetha phakathi kokuhamba ngehost nokuqeda umhubhe ngaphakathi kwe-container. Bhala lokho kukhetha ngaphambi kokusatshalaliswa, hhayi ngemuva kwesicelo sokuqala esihlulekile. Noma yini oyikhethayo, rekhoda ikheli lomthombo elizobonwa uwuhlangothi olukude, ngoba yilokho okuzokhonjiswa imithetho yalo yokufinyelela kanye namarekhodi alo. Umklamo ongakwazi ukusho lelo kheli awukapheleli.

I-DNS ilandela i-daemon, hhayi umhubhe

I-container ithola ukulungiselelwa kwayo kwesixazululi lapho iqala, kukhopishwe kusuka ku-daemon noma kusuka kusithombe. Amakheli e-VPN eziwacindezelayo ngemuva kokuxhuma afika emuva kakhulu kulelo khophi, futhi acindezelwa kusixazululi sehost hhayi ngaphakathi kwe-container.

Setha isixazululi ngokusobala sesevisi, noma sikhombise kusixazululi sangaphakathi esifinyeleleka ngomhubhe. I-container exazulula igama langasese libe ikheli lomphakathi ngokuvamile isebenzisa isixazululi somphakathi, ayihlupheki ngumzila ophukile, futhi isilungiso sisefayelini le-compose noma ekulungiselelweni kwe-daemon.

Ukucabanga okufanayo kusebenza embuzweni wekheli lokuphuma. Uma i-container ngayinye kufanele ibonakale isuka kwikheli le-VPN elihlukile, umhubhe wehost owodwa awukwazi ukukunikeza ngoba i-NAT iwahlanganisa abe umthombo owodwa. Izimo ezisebenzayo iiklayenti endaweni yamagama ye-container ngayinye noma i-sidecar ephethe umhubhe futhi eyabelana ngesitakhi sayo, futhi zombili zishintsha indlela uhlelo lokusebenza olukhehlelwa ngayo.

Uhlu lokuhlola ngaphambi kokuvala ithikithi: thola indawo yamagama ephethe umhubhe, fakazela indlela ngenethiwekhi yehost, hlela kuphela idivayisi ye-tun edingekayo, khumbula ikheli lomthombo ngemuva kwe-NAT, setha isixazululi ngokusobala futhi thatha amakheli okuphuma nge-container ngayinye njengesinqumo somklamo hhayi ifulegi.