我有一个包含Nginx,php,redis和专用于SSH隧道的容器的Docker Compose文件。
我的Mac上有一个ssh配置文件,该文件可以在运行ssh my-tunnel
时按预期工作,并且通过文件./ssh/config
暴露给图像
这是我的ssh隧道的Dockerfile
FROM alpine:edge
RUN apk add --update openssh-client && rm -rf /var/cache/apk/*
# cagataygurturk/docker-ssh-tunnel:0.0.1
CMD rm -rf /root/.ssh && mkdir /root/.ssh && \
cp /run/secrets/ssh_config /root/.ssh/config && \
cp /run/secrets/ssh_key /root/.ssh/id_rsa && \
chmod -R 600 /root/.ssh/* && \
# see https://man.openbsd.org/ssh
ssh -4 -o StrictHostKeyChecking=no -N $TUNNEL_HOST \
&& while true; do sleep 30; done;
EXPOSE 1-65535
这是我的docker-compose.yaml(摘要)
version: '3.1'
services:
php:
...
links:
- ssh-tunnel
ssh-tunnel:
build:
context: ./ssh
secrets:
- ssh_config
- ssh_key
environment:
TUNNEL_HOST: my-tunnel
secrets:
ssh_config:
file: ./ssh/config
ssh_key:
file: ./ssh/id_rsa
我从此容器获得的唯一输出是Warning: Permanently added '[IP_SPECIFIED_IN_CONFIG]:PORT_SPECIFIED_IN_CONFIG_FILE' (ECDSA) to the list of known hosts.
,应用程序无法连接到隧道服务。解决此问题的唯一方法是将CMD
更改为
CMD rm -rf /root/.ssh && mkdir /root/.ssh && \
cp /run/secrets/ssh_config /root/.ssh/config && \
cp /run/secrets/ssh_key /root/.ssh/id_rsa && \
chmod -R 600 /root/.ssh/* && \
# see https://man.openbsd.org/ssh
ssh -4 -o StrictHostKeyChecking=no -N $TUNNEL_HOST \
-L *:$LOCAL_PORT_1:$REMOTE_HOST_1:$REMOTE_PORT_1 \
-L *:$LOCAL_PORT_2:$REMOTE_HOST_2:$REMOTE_PORT_2 \
&& while true; do sleep 30; done;
这并不理想,因为需要多个本地转发,否则我将只使用this container。
为什么使用命令行选项-L
未指定本地转发的配置不起作用?我知道正在读取配置文件(包含本地转发),因为IP地址已添加到known_hosts。
netstat -an
的输出
# WORKING
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address
State
tcp 0 0 127.0.0.11:34951 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:$LOCAT_PORT_2 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:$LOCAL_PORT_1 0.0.0.0:* LISTEN
tcp 0 0 172.20.0.3:34902 HostName:Port
ESTABLISHED
udp 0 0 127.0.0.11:50743 0.0.0.0:*
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
# NOT WORKING
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:$LOCAL_PORT_2 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.11:39857 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:$LOCAL_PORT_1 0.0.0.0:* LISTEN
tcp 0 0 172.21.0.3:47994 Hostname:Port ESTABLISHED
udp 0 0 127.0.0.11:42928 0.0.0.0:*
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node Path
答案 0 :(得分:1)
在我的〜/ .ssh / config文件中找到了答案
LocalForward PORT PUBLIC_URL:PORT
代替
LocalForward *:PORT PUBLIC_URL:PORT