From a5c29b9723ef9f5dfaa6381b77468953673d39cf Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Thu, 10 Jun 2021 10:01:37 -0400 Subject: [PATCH 1/4] make Compose file DRY; add a Compose service for hosting-only with host network in addition to hosting-only with docker network --- ziti-tunnel/docker/docker-compose.yml | 62 ++++++++++++--------------- 1 file changed, 28 insertions(+), 34 deletions(-) diff --git a/ziti-tunnel/docker/docker-compose.yml b/ziti-tunnel/docker/docker-compose.yml index 9877df064..790b706ac 100644 --- a/ziti-tunnel/docker/docker-compose.yml +++ b/ziti-tunnel/docker/docker-compose.yml @@ -1,49 +1,43 @@ version: "3.3" -services: - ziti-test: - image: netfoundry/ziti-tunnel:latest - network_mode: host - cap_add: - - NET_ADMIN - entrypoint: ["sh", "-c", "while true; do sleep 11; done"] - ziti-tproxy: - image: netfoundry/ziti-tunnel:latest - network_mode: host - cap_add: - - NET_ADMIN - volumes: - - .:/netfoundry - environment: + +x-base-service-conf: &base-service-conf + image: netfoundry/ziti-tunnel:latest + volumes: + - .:/netfoundry + environment: - NF_REG_NAME - PFXLOG_NO_JSON=true +​ +services: + ziti-test: + <<: *base-service-conf + network_mode: host + entrypoint: ["sh", "-c", "while true; do sleep 11; done"] + ziti-tproxy: + <<: *base-service-conf + network_mode: host + cap_add: + - NET_ADMIN # iptables filter + - NET_RAW # iptables mangle command: tproxy # command: tproxy --resolver udp://127.0.0.123:53 ziti-iproxy: - image: netfoundry/ziti-tunnel:latest - volumes: - - .:/netfoundry + <<: *base-service-conf network_mode: host cap_add: - - NET_ADMIN - environment: - - NF_REG_NAME - - PFXLOG_NO_JSON=true + - NET_ADMIN # iptables filter + - NET_RAW # iptables mangle command: tproxy --resolver none ziti-proxy: - image: netfoundry/ziti-tunnel:latest - volumes: - - .:/netfoundry - environment: - - NF_REG_NAME - - PFXLOG_NO_JSON=true + <<: *base-service-conf ports: - "8888:8888" - "9999:9999" command: proxy "my example service":8888 "my other example service":9999 - ziti-host: - image: netfoundry/ziti-tunnel:latest - volumes: - - .:/netfoundry - environment: - - NF_REG_NAME + ziti-host-docker: # terminate a service for a server that's reachable by this docker network + <<: *base-service-conf + command: host + ziti-host-egress: # terminate a service for a server that's reachable by the host network + <<: *base-service-conf + network_mode: host command: host From 4c5f83f462fa724baab4b77d7e85e52dea3669cf Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Thu, 10 Jun 2021 12:37:05 -0400 Subject: [PATCH 2/4] document the Compose file --- ziti-tunnel/docker/docker-compose.yml | 58 ++++++++++++++++----------- 1 file changed, 34 insertions(+), 24 deletions(-) diff --git a/ziti-tunnel/docker/docker-compose.yml b/ziti-tunnel/docker/docker-compose.yml index 790b706ac..eddd93084 100644 --- a/ziti-tunnel/docker/docker-compose.yml +++ b/ziti-tunnel/docker/docker-compose.yml @@ -1,43 +1,53 @@ version: "3.3" x-base-service-conf: &base-service-conf - image: netfoundry/ziti-tunnel:latest + image: netfoundry/ziti-tunnel:latest # https://hub.docker.com/r/netfoundry/ziti-tunnel/tags?page=1&ordering=last_updated volumes: - - .:/netfoundry + - .:/netfoundry # mount current dir with identity config file environment: - NF_REG_NAME - PFXLOG_NO_JSON=true ​ services: - ziti-test: - <<: *base-service-conf - network_mode: host - entrypoint: ["sh", "-c", "while true; do sleep 11; done"] - ziti-tproxy: + ziti-tproxy: # iptables transparent interceptor with DNS <<: *base-service-conf network_mode: host cap_add: - - NET_ADMIN # iptables filter - - NET_RAW # iptables mangle - command: tproxy -# command: tproxy --resolver udp://127.0.0.123:53 - ziti-iproxy: - <<: *base-service-conf - network_mode: host - cap_add: - - NET_ADMIN # iptables filter - - NET_RAW # iptables mangle - command: tproxy --resolver none - ziti-proxy: + - NET_ADMIN # iptables filter + - NET_RAW # iptables mangle + dns: # optionally, override DNS inherited from Docker host + - 127.0.0.1 # this first NS must match the built-in nameserver's bind address, + - 1.1.1.1 # and a recursive NS is also needed e.g. 8.8.8.8 + command: + - tproxy + #- --resolver=udp://127.1.2.3:53 # override nameserver bind address (always 53/udp); default is 127.0.0.1 + #- --dnsSvcIpRange=100.64.64.0/18 # override the IP range used for DNS intercepts; default is 100.64/10 + ziti-proxy: # bind a named service to a container port, optionally forward host port to container <<: *base-service-conf ports: - "8888:8888" - "9999:9999" - command: proxy "my example service":8888 "my other example service":9999 - ziti-host-docker: # terminate a service for a server that's reachable by this docker network - <<: *base-service-conf - command: host - ziti-host-egress: # terminate a service for a server that's reachable by the host network + command: + - proxy + - "my example service":8888 # example named service and container port to bind as TCP proxy + #- "my other example service":9999 + ziti-host: # terminate a service for a server that's reachable by the host network <<: *base-service-conf network_mode: host command: host + ziti-bridge: # terminate a service for a server that's reachable by this Docker network + <<: *base-service-conf + command: host + ziti-iproxy: # iptables transparent interceptor without DNS + <<: *base-service-conf + network_mode: host + cap_add: + - NET_ADMIN # iptables filter + - NET_RAW # iptables mangle + command: + - tproxy + - --resolver none + ziti-test: # docker-compose exec ziti-test bash + <<: *base-service-conf + network_mode: host + entrypoint: ["sh", "-c", "while true; do sleep infinity; done"] From 73c845b12103dbe8ee410af6a0c0cdcb62e5ef78 Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Thu, 10 Jun 2021 14:42:32 -0400 Subject: [PATCH 3/4] continue improving Compose file --- ziti-tunnel/docker/docker-compose.yml | 80 +++++++++++++-------------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/ziti-tunnel/docker/docker-compose.yml b/ziti-tunnel/docker/docker-compose.yml index eddd93084..24d8c5b51 100644 --- a/ziti-tunnel/docker/docker-compose.yml +++ b/ziti-tunnel/docker/docker-compose.yml @@ -1,53 +1,53 @@ -version: "3.3" +version: "3.9" -x-base-service-conf: &base-service-conf +x-base-service: &base-service image: netfoundry/ziti-tunnel:latest # https://hub.docker.com/r/netfoundry/ziti-tunnel/tags?page=1&ordering=last_updated volumes: - - .:/netfoundry # mount current dir with identity config file + - .:/netfoundry # mount current dir (relative to Compose file) with identity config file environment: - - NF_REG_NAME - - PFXLOG_NO_JSON=true -​ + - NF_REG_NAME # inherit when run like this: NF_REG_NAME=AcmeIdentity docker-compose up ziti-tproxy + - PFXLOG_NO_JSON=true # suppress JSON logging + network_mode: host # use the Docker host's network, not the Docker bridge + +x-iptables-capabilities: &iptables-capabilities + cap_add: + - NET_ADMIN # iptables filter + - NET_RAW # iptables mangle + services: - ziti-tproxy: # iptables transparent interceptor with DNS - <<: *base-service-conf - network_mode: host - cap_add: - - NET_ADMIN # iptables filter - - NET_RAW # iptables mangle - dns: # optionally, override DNS inherited from Docker host - - 127.0.0.1 # this first NS must match the built-in nameserver's bind address, - - 1.1.1.1 # and a recursive NS is also needed e.g. 8.8.8.8 + ziti-tproxy: # iptables transparent interceptor with DNS + <<: *base-service + <<: *iptables-capabilities + dns: # optionally, override DNS inherited from Docker host + - 127.0.0.1 # this first NS must match the built-in nameserver's bind address, + - 1.1.1.1 # and a recursive NS is also needed e.g. 8.8.8.8 command: - tproxy #- --resolver=udp://127.1.2.3:53 # override nameserver bind address (always 53/udp); default is 127.0.0.1 #- --dnsSvcIpRange=100.64.64.0/18 # override the IP range used for DNS intercepts; default is 100.64/10 - ziti-proxy: # bind a named service to a container port, optionally forward host port to container - <<: *base-service-conf - ports: - - "8888:8888" - - "9999:9999" - command: - - proxy - - "my example service":8888 # example named service and container port to bind as TCP proxy - #- "my other example service":9999 - ziti-host: # terminate a service for a server that's reachable by the host network - <<: *base-service-conf - network_mode: host - command: host - ziti-bridge: # terminate a service for a server that's reachable by this Docker network - <<: *base-service-conf - command: host - ziti-iproxy: # iptables transparent interceptor without DNS - <<: *base-service-conf - network_mode: host - cap_add: - - NET_ADMIN # iptables filter - - NET_RAW # iptables mangle + ziti-tproxy-ip: # iptables transparent interceptor without DNS + <<: *base-service + <<: *iptables-capabilities command: - tproxy - --resolver none - ziti-test: # docker-compose exec ziti-test bash - <<: *base-service-conf - network_mode: host + #- --dnsSvcIpRange=100.64.64.0/18 # override the IP range used for DNS intercepts; default is 100.64/10 + ziti-test: # docker-compose exec ziti-test bash + <<: *base-service + <<: *iptables-capabilities entrypoint: ["sh", "-c", "while true; do sleep infinity; done"] + ziti-host: # terminate a service for a server that's reachable by the host network + <<: *base-service + command: host + ziti-bridge: # terminate a service for a server that's reachable by this Docker network (default mode is "bridge") + <<: *base-service + network_mode: bridge + command: host + ziti-proxy: # bind a named service to a container TCP port, optionally forward host TCP port to container + <<: *base-service + ports: + - "8888:8888" # optionally forward host ports to container ports listening as TCP proxy + network_mode: bridge + command: + - proxy + - '"my example service":8888' # example named service and container port to bind as TCP proxy From 779a875ee4e973302602d4627a83aec3072692cb Mon Sep 17 00:00:00 2001 From: Kenneth Bingham Date: Mon, 9 Aug 2021 17:44:55 -0400 Subject: [PATCH 4/4] only signal if background pid --- ziti-tunnel/docker/docker-entrypoint.sh | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/ziti-tunnel/docker/docker-entrypoint.sh b/ziti-tunnel/docker/docker-entrypoint.sh index 3feb7caa1..abee5d54d 100755 --- a/ziti-tunnel/docker/docker-entrypoint.sh +++ b/ziti-tunnel/docker/docker-entrypoint.sh @@ -3,10 +3,13 @@ set -euo pipefail function alldone() { - # send SIGINT to ziti-tunnel to trigger a cleanup of iptables mangle rules - kill -INT $ZITI_TUNNEL_PID - # let entrypoint script exit after ziti-tunnel PID - wait $ZITI_TUNNEL_PID + # if successfully sent to background then send SIGINT to trigger a cleanup + # of iptables mangle rules and loopback assignments + [[ "${ZITI_TUNNEL_PID:-}" =~ ^[0-9]+$ ]] && { + kill -INT "$ZITI_TUNNEL_PID" + # let entrypoint script exit after ziti-tunnel PID + wait "$ZITI_TUNNEL_PID" + } } trap alldone exit @@ -65,7 +68,7 @@ if iptables -t mangle -S --wait 2>&1 | grep -q "iptables-legacy tables present"; for LEGACY in {ip{,6},eb,arp}tables; do if which ${LEGACY}-legacy &>/dev/null; then echo "INFO: updating $LEGACY alternative to ${LEGACY}-legacy" - update-alternatives --set $LEGACY $(which ${LEGACY}-legacy) + update-alternatives --set $LEGACY "$(which ${LEGACY}-legacy)" else echo "WARN: not updating $LEGACY alternative to ${LEGACY}-legacy" >&2 fi