1

I am attempting to run services in containers within a cloud provider. I would like the containerised applications to authenticate with an on-premises LDAP server, which is (currently) available via an SSH tunnel out to the cloud. The tunnel is available on the docker host machine on 127.0.0.1:6636.

Is it possible to get the containers to access 127.0.0.1:6636 on the host machine, e.g. through some kind of proxy or iptables configuration?

I can get the tunnel to work if I set GatewayPorts=yes in the host's sshd_config and use docker run --add-host to add the host's docker0 IP into /etc/hosts in the container , but that means that the tunnel is available on all interfaces. I can presumably lock down access to the tunnel to the docker0 interface, but I'd rather the tunnel was only on the loopback interface.

I don't want use --net=host, because I want to be able to use container linking.

Cloud                    |
                         |
+------------------+     |      +--------+     +----------+
| Host      Tunnel |     |      | Tunnel |     |   Tunnel |
|                O-------------------------------O Target |
| +-----------+  | |     |      |  Host  |     +----------+
| | Container |--+ |     |      +--------+
| +-----------+    |     |
+------------------+     |      Premises
                         |
1
  • 1
    How about running the tunnel inside a container and linking to that?
    – ptman
    Jul 28, 2015 at 10:46

1 Answer 1

0

You can pass in the IP of your host's docker0 interface as an environment variable and connect to the LDAP Server. As an example, on the host:

$ ip addr show docker0
5: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
inet 10.1.42.1/16 scope global docker0
   valid_lft forever preferred_lft forever
inet6 fe80::60e4:ffff:fe97:1308/64 scope link 
   valid_lft forever preferred_lft forever
$ DOCKERADDR=$(ip addr show docker0 | grep inet\ | awk '{print $2}' | cut -d/ -f1)
$ docker run -it -e DOCKERADDR=${DOCKERADDR} image 

On the inside of the container you can connect to ${DOCKERADDR}:6636

note: on coreos you already have these variables in your environment if you . /etc/environment: COREOS_PUBLIC_IPV4 and COREOS_PRIVATE_IPV4

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .