1

I am attempting to run services in containers within a cloud provider. I would like the containerised applications to authenticate with an on-premises LDAP server, which is (currently) available via an SSH tunnel out to the cloud. The tunnel is available on the docker host machine on 127.0.0.1:6636.

Is it possible to get the containers to access 127.0.0.1:6636 on the host machine, e.g. through some kind of proxy or iptables configuration?

I can get the tunnel to work if I set GatewayPorts=yes in the host's sshd_config and use docker run --add-host to add the host's docker0 IP into /etc/hosts in the container , but that means that the tunnel is available on all interfaces. I can presumably lock down access to the tunnel to the docker0 interface, but I'd rather the tunnel was only on the loopback interface.

I don't want use --net=host, because I want to be able to use container linking.

Cloud                    |
                         |
+------------------+     |      +--------+     +----------+
| Host      Tunnel |     |      | Tunnel |     |   Tunnel |
|                O-------------------------------O Target |
| +-----------+  | |     |      |  Host  |     +----------+
| | Container |--+ |     |      +--------+
| +-----------+    |     |
+------------------+     |      Premises
                         |
  • 1
    How about running the tunnel inside a container and linking to that? – ptman Jul 28 '15 at 10:46
0

You can pass in the IP of your host's docker0 interface as an environment variable and connect to the LDAP Server. As an example, on the host:

$ ip addr show docker0
5: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
inet 10.1.42.1/16 scope global docker0
   valid_lft forever preferred_lft forever
inet6 fe80::60e4:ffff:fe97:1308/64 scope link 
   valid_lft forever preferred_lft forever
$ DOCKERADDR=$(ip addr show docker0 | grep inet\ | awk '{print $2}' | cut -d/ -f1)
$ docker run -it -e DOCKERADDR=${DOCKERADDR} image 

On the inside of the container you can connect to ${DOCKERADDR}:6636

note: on coreos you already have these variables in your environment if you . /etc/environment: COREOS_PUBLIC_IPV4 and COREOS_PRIVATE_IPV4

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.