Kungani ama-container e-Docker engayinaki i-DNS resolver ye-VPN

I-VPN iyasebenza, isiphequluli sifinyelela amasayithi angaphakathi, kodwa i-container ayikwazi ukuxazulula lawo magama. Ukufakwa kwephakethe kufa ngephutha lokuxazulula igama njenge-EAI_AGAIN, noma uhlelo lokusebenza alutholi i-host yedatha i-host machine eyixazulula ngaphandle kwesikhalazo. I-container ayisebenzisi i-resolver efakwe yi-VPN. I-Docker ikopisha ukucushwa kwe-resolver ye-host ngesikhathi kwakhiwa i-container, futhi akukho okwakukopisha futhi ngemuva kwalokho.

Imibono emibili ye-resolver kumshini owodwa

Ku-Linux, i-Docker inikeza i-container ngayinye ikhophi ye-ukucushwa kwe-resolver ye-host ngesikhathi sokwakha, ihlunga amakheli e-loopback, futhi isebenzisa iseva ye-DNS efakiwe ku-127.0.0.11 edlulisela imibuzo ngaphandle. Iklayenti le-VPN elibhala kabusha i-/etc/resolv.conf ngemuva kokuthi i-container iqalile alishintshi lutho ngaphakathi kwayo. Ukuqalisa kabusha i-container kusiza kuphela uma i-resolver ye-host yayiqondile ngesikhathi leso ngeshwa.

I-Docker Desktop ku-macOS noma ku-Windows yengeza ungqimba, ngoba i-daemon ihlala kumshini ongesikhathi. I-resolver ye-VPN ye-host ingase ingabonakali kulelo VM, ngakho ukuqalisa kabusha akushintshi lutho nakancane. Qhathanisa imibono emibili ngaphambi kokukhetha isixazululo: i-docker exec mycontainer cat /etc/resolv.conf eceleni kohlu lwama-resolver e-host.

I-container ebala i-resolver yomphakathi ngenkathi i-host ibala eyangaphakathi izoxazulula amagama omphakathi yehluleke kwangaphakathi. Lokho kwehlukanisa kuwuphawu lwale nkinga.

Inketho A: dlulisa i-resolver yethumbu ku-container ngayinye

I-Docker yamukela izilungiselelo ze-DNS ku-container ngayinye, futhi lokho ukushintsha okuncane okusebenzayo. Qala ngokufunda amakheli e-resolver ye-VPN: i-scutil --dns ku-macOS, i-resolvectl status noma okukhiphayo kwesimo seklayenti ngokwalo ku-Linux. Bese uqalisa i-container ngalokho, isibonelo i-docker run --dns 192.168.2.1 --dns 192.168.123.1 myimage. Ku-Compose isilungiselelo esifanayo uhlu ngaphansi kwensizakalo, lapho lihlala khona ekulawulweni kwezinguqulo esikhundleni somlando we-shell womuntu.

Uhlu lwe-dns ku-/etc/docker/daemon.json lusebenza ku-container ngayinye entsha, okuzwakala kukuhle kodwa akunjalo. Lusebenza futhi uma ithumbu liplile, futhi lapho i-resolver efinyeleleka kuphela nge-VPN ibhidliza ukudonsa kwezithombe okuvamile. Izilungiselelo zekhontheyna ngayinye zilula ukuzithethelela futhi zilula ukuzihoxisa.

Inketho B: vumela i-container yabelane ngenethiwekhi ye-host

Inethiwekhi ye-host yeqa ikhophi ngokuphelele, ngoba i-container isebenzisa i-resolver ye-host nethumbu le-host. Iyasusa futhi ukwahlukanisa kwenethiwekhi obukade uyifuna, futhi ayiziphathi ngendlela efanayo ngaphansi kwe-Docker Desktop. Ku-Linux lokhu ukukhetha okunengqondo kwethuluzi lesikhathi esisodwa okufanele lixazulule amagama angaphakathi.

Kuma-build akukho nketho kulezi ezimbili esebenzayo, ngoba izinyathelo zokwakha azizuzi amafulegi esikhathi sokusebenza. Yakha ngenethiwekhi ye-host lapho ipulatifomu ivuma khona, noma gcina ukufakwa kwemibhalo encikile ezigabeni ezingayidingi ithumbu.

Okungekho nketho kulezi ezimbili okulungisayo

Ikheli le-DNS aliwusizo uma i-container ingenayo indlela yokufika kulo. I-resolver ye-VPN ivamise ukuhlala ngaphakathi kwesikhala samakheli sethumbu, ngakho i-container idinga indlela eya kuleso siqalo. Ibhuloho elizenzakalelayo le-Docker livamise ukuqondisa ngaphandle ngokusebenzisa i-host, futhi lokho kwanele uma i-host inendlela yethumbu futhi ukudlulisela kuvuliwe. Amanethiwekhi ebhuloho enziwe ngokwezifiso anamachibi akhe amakheli angashayisana ne-subnet ye-VPN, futhi lapho imibuzo iya kwenye indawo ngokuphelele.

Hlola i-subnet yenethiwekhi ye-Docker uma iqhathaniswa ne-subnet ye-VPN ngaphambi kokulungisa i-resolver uqobo. Ukweqana kukhiqiza ukwehluleka okubonakala kufana ncamashi neseva ye-DNS ephukile.

Qinisekisa ngaphakathi kwe-container

Hlola nge-getent hosts db.internal ngaphakathi kwe-container esikhundleni sesiphequluli noma indawo yokusebenza yolimi, ngoba lezo zisebenzisa inqubomgomo yazo ye-DNS nesitoreji sazo sesikhashana. Uma i-getent ixazulula igama futhi uhlelo lokusebenza lusahluleka, i-resolver manje isilungile futhi inkinga esele isezingeni lohlelo lokusebenza. Uma ingalixazululi, isinyathelo se-DNS asikapheli.

Dala kabusha i-container ngemuva kokushintsha izilungiselelo zayo ze-DNS. Ukuhlela i-/etc/resolv.conf ngaphakathi kwe-container esebenzayo kuyanyamalala kanye nayo futhi kufihla inkinga yokucushwa isikhathi esilingana ncamashi nesidingekayo ukuze umuntu ayiqalise kabusha.