I am attempting to run services in containers within a cloud provider. I would like the containerised applications to authenticate with an on-premises LDAP server, which is (currently) available via an SSH tunnel out to the cloud. The tunnel is available on the docker host machine on 127.0.0.1:6636
.
Is it possible to get the containers to access 127.0.0.1:6636
on the host machine, e.g. through some kind of proxy or iptables configuration?
I can get the tunnel to work if I set GatewayPorts=yes
in the host's sshd_config
and use docker run --add-host
to add the host's docker0
IP into /etc/hosts
in the container , but that means that the tunnel is available on all interfaces. I can presumably lock down access to the tunnel to the docker0
interface, but I'd rather the tunnel was only on the loopback interface.
I don't want use --net=host
, because I want to be able to use container linking.
Cloud |
|
+------------------+ | +--------+ +----------+
| Host Tunnel | | | Tunnel | | Tunnel |
| O-------------------------------O Target |
| +-----------+ | | | | Host | +----------+
| | Container |--+ | | +--------+
| +-----------+ | |
+------------------+ | Premises
|