关于【docker】的问题- 第1页

Jean

Asked: 2025-02-21 21:04:37 +0800 CST

Problema com Fail2ban no meu Docker Xibo

6

No momento, estou tentando fazer o Fail2ban funcionar com meu contêiner Xibo, mas mesmo estando listado como banido, ainda consigo tentar fazer login.

debian@vps-ec7a07fd:~/xibo$ sudo fail2ban-client status xibo
Status for the jail: xibo
|- Filter
|  |- Currently failed: 1
|  |- Total failed:     7
|  `- File list:        /var/log/xilog/container.log
`- Actions
   |- Currently banned: 1
   |- Total banned:     1
   `- Banned IP list:   172.18.0.1

Fui verificar o IPtables, mas não vejo nada de anormal.

 pkts bytes target     prot opt in     out     source               destination
 32  6227 f2b-xibo   6    --  *      *       0.0.0.0/0            0.0.0.0/0            
 multiport dports 80,443

E, finalmente, não vejo nenhum erro no fail2ban.log.

2025-02-21 12:35:55,883 fail2ban.filter         [133082]: INFO    [xibo] Found 
172.18.0.1 - 2025-02-21 12:35:55
2025-02-21 12:35:57,813 fail2ban.filter         [133082]: INFO    [xibo] Found 
172.18.0.1 - 2025-02-21 12:35:57
2025-02-21 12:36:00,516 fail2ban.filter         [133082]: INFO    [xibo] Found 
172.18.0.1 - 2025-02-21 12:35:59
2025-02-21 12:36:00,674 fail2ban.actions        [133082]: NOTICE  [xibo] Ban 172.18.0.1
2025-02-21 12:36:02,119 fail2ban.filter         [133082]: INFO    [xibo] Found 
172.18.0.1 - 2025-02-21 12:36:01
2025-02-21 12:36:03,743 fail2ban.filter         [133082]: INFO    [xibo] Found 
172.18.0.1 - 2025-02-21 12:36:03
2025-02-21 12:36:05,501 fail2ban.filter         [133082]: INFO    [xibo] Found 
172.18.0.1 - 2025-02-21 12:36:05
2025-02-21 12:36:05,904 fail2ban.actions        [133082]: NOTICE  [xibo] 172.18.0.1 a 
lready banned
2025-02-21 12:36:07,244 fail2ban.filter         [133082]: INFO    [xibo] Found 
172.18.0.1 - 2025-02-21 12:36:07
2025-02-21 12:39:05,184 fail2ban.actions        [133082]: NOTICE  [xibo] Unban 
172.18.0.1

Se você tiver alguma ideia de onde o problema pode estar vindo, estou aberto a sugestões.

CarloC

Asked: 2024-11-13 16:43:07 +0800 CST

Anexar gdb de um contêiner docker a um processo em execução em um namespace PID diferente

5

Criei uma imagem docker com gcco binutils e gdbo debugger instalados dentro.

Eu anexaria gdbdesse contêiner docker a um processo dentro de um lxccontêiner em execução no mesmo host Linux. O lxccontêiner usa seu próprio PIDnamespace, portanto, gdba execução no contêiner docker reclama que o processo de destino e o depurador não estão no mesmo PIDnamespace.

[SR-PCE-251:~]$ docker run -it --pid host --rm --cap-add=SYS_PTRACE --security-opt seccomp=unconfined carlo/ubuntu
root@e7b2db23af34:/#
root@e7b2db23af34:/# id
uid=0(root) gid=0(root) groups=0(root)
root@e7b2db23af34:/# 
root@e7b2db23af34:/# gdb -q attach 11365
attach: No such file or directory.
Attaching to process 11365
[New LWP 24283]
[New LWP 20025]
[New LWP 20024]
[New LWP 19992]
[New LWP 19991]
[New LWP 13974]
[New LWP 13970]
[New LWP 13969]
[New LWP 13968]
[New LWP 13967]
[New LWP 13962]
[New LWP 13958]
[New LWP 13957]
[New LWP 13954]
[New LWP 13952]
[New LWP 13944]
[New LWP 12078]
[New LWP 11822]
[New LWP 11543]
[New LWP 11515]
[New LWP 11489]
[New LWP 11483]
[New LWP 11482]
[New LWP 11477]
[New LWP 11476]

warning: "target:/proc/11365/exe": could not open as an executable file: Operation not permitted.

warning: `target:/proc/11365/exe': can't open to read symbols: Operation not permitted.

warning: Could not load vsyscall page because no executable was specified

warning: Target and debugger are in different PID namespaces; thread lists and other data are likely unreliable.  Connect to gdbserver inside the container.
0x00007f0bf997ac73 in ?? ()
(gdb)

Como posso me livrar disso?

jamshid

Asked: 2024-10-12 01:05:33 +0800 CST

Por que o "dig" no rockylinux 9 não consegue encontrar um contêiner/host chamado "https" em uma rede docker compose?

6

Desculpe, não sei se isso é um problema do Docker ou do DIG no RockyLinux 9. Tudo funciona como esperado no RockyLinux 8.

Tenho um docker-compose.ymlarquivo abaixo com um serviço chamado https. Isso permite que o contêiner seja referenciado pelo nome do host https. Enquanto ping httpsfunciona, por algum motivo dig https( DiG 9.16.23-RH) não funciona no rockylinux 9. Funciona no rockylinux 8 ( DiG 9.11.36-RedHat-9.11.36-16.el8_10.2). Se eu mudar o nome do serviço para httpsxentão dig httpsxfunciona.

services:
  https:
    image: "rockylinux:${RL_VERSION}"
    command: bash -c "yum install -y iputils bind-utils && echo '=====dig version output====' && dig -v && echo '=====ping https output====' && ping -c 3 https && echo '=====dig https output====' && dig +short https"
    environment:
       - RL_VERSION

Trabalhando 8:

% RL_VERSION=8 docker-compose up
Attaching to https-1
https-1  | Rocky Linux 8 - AppStream                       5.7 MB/s |  11 MB     00:01    
...
https-1  | Complete!
https-1  | =====dig version output====
https-1  | DiG 9.11.36-RedHat-9.11.36-16.el8_10.2
https-1  | =====ping https output====
https-1  | PING https (172.21.0.2) 56(84) bytes of data.
https-1  | 64 bytes from c3f0c7a6613c (172.21.0.2): icmp_seq=1 ttl=64 time=0.558 ms
https-1  | 64 bytes from c3f0c7a6613c (172.21.0.2): icmp_seq=2 ttl=64 time=0.051 ms
https-1  | 64 bytes from c3f0c7a6613c (172.21.0.2): icmp_seq=3 ttl=64 time=0.040 ms
https-1  | 
https-1  | --- https ping statistics ---
https-1  | 3 packets transmitted, 3 received, 0% packet loss, time 2025ms
https-1  | rtt min/avg/max/mdev = 0.040/0.216/0.558/0.241 ms
https-1  | =====dig https output====
https-1  | 172.21.0.2

Falha 9:

% RL_VERSION=9 docker-compose up
[+] Running 1/1
 ✔ Container testhttps-https-1  Recreated                                                                                                    0.2s 
Attaching to https-1
https-1  | Rocky Linux 9 - BaseOS                          2.4 MB/s | 2.4 MB     00:00    
...
https-1  | Complete!
https-1  | =====dig version output====
https-1  | DiG 9.16.23-RH
https-1  | =====ping https output====
https-1  | PING https (172.21.0.2) 56(84) bytes of data.
https-1  | 64 bytes from 4a2841b5dac9 (172.21.0.2): icmp_seq=1 ttl=64 time=0.404 ms
https-1  | 64 bytes from 4a2841b5dac9 (172.21.0.2): icmp_seq=2 ttl=64 time=0.117 ms
https-1  | 64 bytes from 4a2841b5dac9 (172.21.0.2): icmp_seq=3 ttl=64 time=0.088 ms
https-1  | 
https-1  | --- https ping statistics ---
https-1  | 3 packets transmitted, 3 received, 0% packet loss, time 2009ms
https-1  | rtt min/avg/max/mdev = 0.088/0.203/0.404/0.142 ms
https-1  | =====dig https output====
https-1  | c.root-servers.net.
https-1  | l.root-servers.net.
https-1  | e.root-servers.net.
https-1  | d.root-servers.net.
https-1  | i.root-servers.net.
https-1  | b.root-servers.net.
https-1  | g.root-servers.net.
https-1  | m.root-servers.net.
https-1  | a.root-servers.net.
https-1  | f.root-servers.net.
https-1  | h.root-servers.net.
https-1  | j.root-servers.net.
https-1  | k.root-servers.net.

atl123

Asked: 2024-09-21 04:50:24 +0800 CST

driver de registro syslog dando erro protocolo tipo errado para soquete

4

Tenho um serviço definido via docker compose (veja a definição abaixo). Quando tentei iniciar esse serviço via docker-compose -f up --wait -d my_service, obtive o erro

Error response from daemon: failed to create task for container: failed to initialize logging driver: dial unix /dev/log: connect: protocol wrong type for socket

No meu servidor host, onde estou executando o comando docker compose, vejo que o soquete existe e meu usuário tem permissões de gravação:

srw-rw-rw-. 1 root root 0 Aug 29  2023 /dev/log

definição de serviço:

  my_service:
    command: <omitted>
    image: <omitted>
    volumes:
      - "/dev/log:/dev/log"
    logging:
      driver: "syslog"
      options:
        syslog-address: "unix:///dev/log"
        tag: "my_service"

Alguém sabe o que pode estar causando esse erro?

Franz Wong

Asked: 2024-09-06 21:40:19 +0800 CST

cgroup memory.max é substituído pelo docker

5

Criei o cgroup mygroup.slicecom o seguinte script. O valor de memory.maxé 200M. Posso ver o conteúdo de memory.maxé 209715200.

sudo mkdir -p /sys/fs/cgroup/mygroup.slice
echo "200M" | sudo tee "/sys/fs/cgroup/mygroup.slice/memory.max"
echo "+memory" | sudo tee "/sys/fs/cgroup/mygroup.slice/cgroup.subtree_control"
cat "/sys/fs/cgroup/mygroup.slice/memory.max"

Então iniciei um contêiner docker com cgroup-parent.

docker run -d --cgroup-parent mygroup.slice --env CONTAINER_NAME=container1 --name container1 simple/container1

Depois disso o conteúdo de memory.maxé maxem vez de 209715200.

Como posso impedir que o docker substitua isso? Obrigado.

Aqui estão os detalhes do meu ambiente.

O cgroup v2 é usado.

stat -fc %T /sys/fs/cgroup/
cgroup2fs

Aqui está a saída dedocker version

docker version
Client: Docker Engine - Community
 Version:           27.2.0
 API version:       1.47
 Go version:        go1.21.13
 Git commit:        3ab4256
 Built:             Tue Aug 27 14:15:45 2024
 OS/Arch:           linux/arm64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          27.2.0
  API version:      1.47 (minimum version 1.24)
  Go version:       go1.21.13
  Git commit:       3ab5c7d
  Built:            Tue Aug 27 14:15:45 2024
  OS/Arch:          linux/arm64
  Experimental:     false
 containerd:
  Version:          1.7.21
  GitCommit:        472731909fa34bd7bc9c087e4c27943f9835f111
 runc:
  Version:          1.1.13
  GitCommit:        v1.1.13-0-g58aa920
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

Daniel Walker

Asked: 2024-09-05 22:39:30 +0800 CST

Examinar procfs para contêiner baseado em scratch

5

Estou desenvolvendo um aplicativo que estou enviando como uma imagem Docker. Meu aplicativo consiste em um único arquivo executável que vincula apenas com libc e libcrypto. Estou pensando em tornar minha imagem menor vinculando estaticamente o executável e colocando-o dentro de uma imagem de rascunho.

Meu problema vem do meu teste. Durante o teste, quero confirmar se meu aplicativo, que escuta em várias portas (TCP e UDP), se levantou corretamente. Tenho feito isso executando cat /proc/net/<file>via docker exec. No entanto, com uma imagem de rascunho, não terei acesso a catou mesmo sh.

Eu sei que eu poderia, durante o teste, lançar o BusyBox dentro do contêiner. No entanto, há uma maneira de examinar o sistema de arquivos proc usando apenas docker?

tentei

docker cp the_container:/proc/net/tcp .

mas deu erro

Resposta de erro do daemon: Não foi possível encontrar o arquivo /proc/net/tcp no contêiner the_container

KronwarsCZ

Asked: 2024-07-26 00:42:55 +0800 CST

Roteando o tráfego para o contêiner docker a partir de um IP de origem específico

5

Atualmente estou enfrentando problemas com o roteamento de tráfego de fora para um contêiner docker.

Esta é a minha configuração:

Anfitrião Rocky Linux 9.4
Rede Docker (bridge) com faixa de IP 172.20.0.0/16
3 contêineres docker (executando mecanismo de varredura Rapid7, mas isso não é importante), cada um tem um serviço disponível na porta 40814, mas não são exportados, além disso, cada servidor possui um IP estático (172.20.0.2-4) nessa rede docker
configuração do firewalld no host:

public (active)
 target: default
 icmp-block-inversion: no
 interfaces: ens192
 sources:
 services: cockpit dhcpv6-client ssh
 ports: 10050/tcp 40814/tcp
 protocols:
 forward: yes
 masquerade: yes
 forward-ports:
   port=40814:proto=tcp:toport=40814:toaddr=172.20.0.2
 source-ports:
 icmp-blocks:
 rich rules:

O que estou tentando alcançar é que, com base em um determinado IP de origem (outro servidor na minha rede), eu gostaria de rotear o tráfego para um dos três contêineres do docker. O outro servidor conhece apenas o IP do meu servidor Rocky Linux e a porta 40814, então o servidor Rocky Linux decide para qual docker rotear o tráfego. Esta não é uma tentativa de balanceamento de carga.

Consigo verificar se o contêiner do docker está funcionando corretamente telnet 172.20.0.2 40814(do servidor host/rocky linux), que mostra tentativas de conexão nos logs do contêiner do docker, mas quando tento fazer telnet 10.0.20.123 40814(ip do servidor rocky linux) de outros servidores no meu rede, eu só consigo Trying 10.0.20.123.... Tentar qualquer outra porta nesse IP termina imediatamente em Connection refused. Os logs também não relatam tentativas de conexão.

Eu tentei diferentes configurações de firewall como esta:

One:
firewall-cmd --add-rich-rule='rule 
family="ipv4" \
source address="10.0.20.120/32" \
port protocol="tcp" port="40814" accept'
firewall-cmd --add-forward-port=port=40814:proto=tcp:toport=40814:toaddr=172.20.0.2
firewall-cmd --zone=public --add-forward-port=port=41814:proto=tcp:toaddr=172.20.0.2:toport=40814 --permanent 

Two:
firewall-cmd --add-rich-rule='rule 
family="ipv4" \
source address="10.0.20.120/32" \
forward-port protocol="tcp" port="41814" toport=40814 toaddr=172.20.0.2'

SELinux é Enforcing, mas não tenho certeza se isso faz diferença.

Você pode ajudar? Muito obrigado!

Editar: adicionando mais algumas informações

informações do docker relacionadas à rede:

"NetworkSettings": {
            "Bridge": "",
            "SandboxID": "06e60f163d002b1ef377542172f4007dcfa33749bf104315047921ac8af0d8c0",
            "SandboxKey": "/var/run/docker/netns/06e60f163d00",
            "Ports": {},
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "",
            "Gateway": "",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "",
            "IPPrefixLen": 0,
            "IPv6Gateway": "",
            "MacAddress": "",
            "Networks": {
                "se-net": {
                    "IPAMConfig": {
                        "IPv4Address": "172.20.0.2"
                    },
                    "Links": null,
                    "Aliases": [
                        "nse-1",
                        "nse-1"
                    ],
                    "MacAddress": "02:42:ac:14:00:02",
                    "DriverOpts": null,
                    "NetworkID": "ae57f90864d9171ee342803f1ce2d336db530482f000e8a7c2c4ef44fb9f09b9",
                    "EndpointID": "9f12ea7fca0ce272d3cfcd4797a4d68d88c9542d2b2ce7616581a0f2aff32f90",
                    "Gateway": "172.20.0.1",
                    "IPAddress": "172.20.0.2",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "DNSNames": [
                        "nse-1",
                        "7ee892f16d9f"
                    ]
                }
            }
        }

iptables-save

# Generated by iptables-save v1.8.10 (nf_tables) on Fri Jul 26 10:56:54 2024
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [822:49320]
:OUTPUT ACCEPT [0:0]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o br-ae57f90864d9 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-ae57f90864d9 -j DOCKER
-A FORWARD -i br-ae57f90864d9 ! -o br-ae57f90864d9 -j ACCEPT
-A FORWARD -i br-ae57f90864d9 -o br-ae57f90864d9 -j ACCEPT
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i br-ae57f90864d9 ! -o br-ae57f90864d9 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o br-ae57f90864d9 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
COMMIT
# Completed on Fri Jul 26 10:56:54 2024
# Generated by iptables-save v1.8.10 (nf_tables) on Fri Jul 26 10:56:54 2024
*nat
:PREROUTING ACCEPT [434998:26094074]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [62817:4380590]
:POSTROUTING ACCEPT [62817:4380590]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.20.0.0/16 ! -o br-ae57f90864d9 -j MASQUERADE
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A DOCKER -i br-ae57f90864d9 -j RETURN
-A DOCKER -i docker0 -j RETURN
COMMIT
# Completed on Fri Jul 26 10:56:54 2024

conjunto de regras da lista NFT

# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
    chain DOCKER {
        iifname "br-ae57f90864d9" counter packets 0 bytes 0 return
        iifname "docker0" counter packets 0 bytes 0 return
    }

    chain POSTROUTING {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 172.20.0.0/16 oifname != "br-ae57f90864d9" counter packets 15 bytes 900 masquerade
        ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 masquerade
    }

    chain PREROUTING {
        type nat hook prerouting priority dstnat; policy accept;
        fib daddr type local counter packets 433464 bytes 26008040 jump DOCKER
    }

    chain OUTPUT {
        type nat hook output priority dstnat; policy accept;
        ip daddr != 127.0.0.0/8 fib daddr type local counter packets 0 bytes 0 jump DOCKER
    }
}
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
    chain DOCKER {
    }

    chain DOCKER-ISOLATION-STAGE-1 {
        iifname "br-ae57f90864d9" oifname != "br-ae57f90864d9" counter packets 15 bytes 900 jump DOCKER-ISOLATION-STAGE-2
        iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
        counter packets 20043 bytes 21105956 return
    }

    chain DOCKER-ISOLATION-STAGE-2 {
        oifname "br-ae57f90864d9" counter packets 0 bytes 0 drop
        oifname "docker0" counter packets 0 bytes 0 drop
        counter packets 6609 bytes 387973 return
    }

    chain FORWARD {
        type filter hook forward priority filter; policy drop;
        counter packets 821 bytes 49260 jump DOCKER-USER
        counter packets 821 bytes 49260 jump DOCKER-ISOLATION-STAGE-1
        oifname "br-ae57f90864d9" ct state related,established counter packets 0 bytes 0 accept
        oifname "br-ae57f90864d9" counter packets 0 bytes 0 jump DOCKER
        iifname "br-ae57f90864d9" oifname != "br-ae57f90864d9" counter packets 15 bytes 900 accept
        iifname "br-ae57f90864d9" oifname "br-ae57f90864d9" counter packets 0 bytes 0 accept
        oifname "docker0" ct state related,established counter packets 0 bytes 0 accept
        oifname "docker0" counter packets 870 bytes 52200 jump DOCKER
        iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept
        iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
    }

    chain DOCKER-USER {
        counter packets 20043 bytes 21105956 return
    }
}
table ip6 nat {
    chain DOCKER {
    }
}
table ip6 filter {
    chain DOCKER {
    }

    chain DOCKER-ISOLATION-STAGE-1 {
        iifname "br-ae57f90864d9" oifname != "br-ae57f90864d9" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
        iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2
        counter packets 0 bytes 0 return
    }

    chain DOCKER-ISOLATION-STAGE-2 {
        oifname "br-ae57f90864d9" counter packets 0 bytes 0 drop
        oifname "docker0" counter packets 0 bytes 0 drop
        counter packets 0 bytes 0 return
    }

    chain FORWARD {
        type filter hook forward priority filter; policy drop;
        counter packets 0 bytes 0 jump DOCKER-USER
    }

    chain DOCKER-USER {
        counter packets 0 bytes 0 return
    }
}
table inet firewalld {
    chain mangle_PREROUTING {
        type filter hook prerouting priority mangle + 10; policy accept;
        jump mangle_PREROUTING_ZONES
    }

    chain mangle_PREROUTING_POLICIES_pre {
        jump mangle_PRE_policy_allow-host-ipv6
    }

    chain mangle_PREROUTING_ZONES {
        iifname "br-ae57f90864d9" goto mangle_PRE_docker
        iifname "docker0" goto mangle_PRE_docker
        iifname "ens192" goto mangle_PRE_public
        goto mangle_PRE_public
    }

    chain mangle_PREROUTING_POLICIES_post {
    }

    chain nat_PREROUTING {
        type nat hook prerouting priority dstnat + 10; policy accept;
        jump nat_PREROUTING_ZONES
    }

    chain nat_PREROUTING_POLICIES_pre {
        jump nat_PRE_policy_allow-host-ipv6
    }

    chain nat_PREROUTING_ZONES {
        iifname "br-ae57f90864d9" goto nat_PRE_docker
        iifname "docker0" goto nat_PRE_docker
        iifname "ens192" goto nat_PRE_public
        goto nat_PRE_public
    }

    chain nat_PREROUTING_POLICIES_post {
    }

    chain nat_POSTROUTING {
        type nat hook postrouting priority srcnat + 10; policy accept;
        jump nat_POSTROUTING_ZONES
    }

    chain nat_POSTROUTING_POLICIES_pre {
        oifname { "docker0", "br-ae57f90864d9" } jump nat_POST_policy_docker-forwarding
    }

    chain nat_POSTROUTING_ZONES {
        oifname "br-ae57f90864d9" goto nat_POST_docker
        oifname "docker0" goto nat_POST_docker
        oifname "ens192" goto nat_POST_public
        goto nat_POST_public
    }

    chain nat_POSTROUTING_POLICIES_post {
    }

    chain nat_OUTPUT {
        type nat hook output priority dstnat + 10; policy accept;
        jump nat_OUTPUT_POLICIES_pre
        jump nat_OUTPUT_POLICIES_post
    }

    chain nat_OUTPUT_POLICIES_pre {
    }

    chain nat_OUTPUT_POLICIES_post {
    }

    chain filter_PREROUTING {
        type filter hook prerouting priority filter + 10; policy accept;
        icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
        meta nfproto ipv6 fib saddr . mark . iif oif missing drop
    }

    chain filter_INPUT {
        type filter hook input priority filter + 10; policy accept;
        ct state { established, related } accept
        ct status dnat accept
        iifname "lo" accept
        ct state invalid drop
        jump filter_INPUT_ZONES
        reject with icmpx admin-prohibited
    }

    chain filter_FORWARD {
        type filter hook forward priority filter + 10; policy accept;
        ct state { established, related } accept
        ct status dnat accept
        iifname "lo" accept
        ct state invalid drop
        ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
        jump filter_FORWARD_ZONES
        reject with icmpx admin-prohibited
    }

    chain filter_OUTPUT {
        type filter hook output priority filter + 10; policy accept;
        ct state { established, related } accept
        oifname "lo" accept
        ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
        jump filter_OUTPUT_POLICIES_pre
        jump filter_OUTPUT_POLICIES_post
    }

    chain filter_INPUT_POLICIES_pre {
        jump filter_IN_policy_allow-host-ipv6
    }

    chain filter_INPUT_ZONES {
        iifname "br-ae57f90864d9" goto filter_IN_docker
        iifname "docker0" goto filter_IN_docker
        iifname "ens192" goto filter_IN_public
        goto filter_IN_public
    }

    chain filter_INPUT_POLICIES_post {
    }

    chain filter_FORWARD_POLICIES_pre {
        oifname { "docker0", "br-ae57f90864d9" } jump filter_FWD_policy_docker-forwarding
    }

    chain filter_FORWARD_ZONES {
        iifname "br-ae57f90864d9" goto filter_FWD_docker
        iifname "docker0" goto filter_FWD_docker
        iifname "ens192" goto filter_FWD_public
        goto filter_FWD_public
    }

    chain filter_FORWARD_POLICIES_post {
    }

    chain filter_OUTPUT_POLICIES_pre {
    }

    chain filter_OUTPUT_POLICIES_post {
    }

    chain filter_IN_public {
        jump filter_INPUT_POLICIES_pre
        jump filter_IN_public_pre
        jump filter_IN_public_log
        jump filter_IN_public_deny
        jump filter_IN_public_allow
        jump filter_IN_public_post
        jump filter_INPUT_POLICIES_post
        meta l4proto { icmp, ipv6-icmp } accept
        reject with icmpx admin-prohibited
    }

    chain filter_IN_public_pre {
    }

    chain filter_IN_public_log {
    }

    chain filter_IN_public_deny {
    }

    chain filter_IN_public_allow {
        tcp dport 22 accept
        ip6 daddr fe80::/64 udp dport 546 accept
        tcp dport 9090 accept
        tcp dport 10050 accept
        tcp dport 40814 accept
    }

    chain filter_IN_public_post {
    }

    chain nat_POST_public {
        jump nat_POSTROUTING_POLICIES_pre
        jump nat_POST_public_pre
        jump nat_POST_public_log
        jump nat_POST_public_deny
        jump nat_POST_public_allow
        jump nat_POST_public_post
        jump nat_POSTROUTING_POLICIES_post
    }

    chain nat_POST_public_pre {
    }

    chain nat_POST_public_log {
    }

    chain nat_POST_public_deny {
    }

    chain nat_POST_public_allow {
        meta nfproto ipv4 oifname != "lo" masquerade
    }

    chain nat_POST_public_post {
    }

    chain filter_FWD_public {
        jump filter_FORWARD_POLICIES_pre
        jump filter_FWD_public_pre
        jump filter_FWD_public_log
        jump filter_FWD_public_deny
        jump filter_FWD_public_allow
        jump filter_FWD_public_post
        jump filter_FORWARD_POLICIES_post
        reject with icmpx admin-prohibited
    }

    chain filter_FWD_public_pre {
    }

    chain filter_FWD_public_log {
    }

    chain filter_FWD_public_deny {
    }

    chain filter_FWD_public_allow {
        oifname "ens192" accept
    }

    chain filter_FWD_public_post {
    }

    chain nat_PRE_public {
        jump nat_PREROUTING_POLICIES_pre
        jump nat_PRE_public_pre
        jump nat_PRE_public_log
        jump nat_PRE_public_deny
        jump nat_PRE_public_allow
        jump nat_PRE_public_post
        jump nat_PREROUTING_POLICIES_post
    }

    chain nat_PRE_public_pre {
    }

    chain nat_PRE_public_log {
    }

    chain nat_PRE_public_deny {
    }

    chain nat_PRE_public_allow {
        ip saddr 10.0.20.120 tcp dport 40814 dnat ip to 172.17.0.2:40814
        ip saddr 10.0.20.120 tcp dport 40814 dnat ip to 172.20.0.2:40814
    }

    chain nat_PRE_public_post {
    }

    chain mangle_PRE_public {
        jump mangle_PREROUTING_POLICIES_pre
        jump mangle_PRE_public_pre
        jump mangle_PRE_public_log
        jump mangle_PRE_public_deny
        jump mangle_PRE_public_allow
        jump mangle_PRE_public_post
        jump mangle_PREROUTING_POLICIES_post
    }

    chain mangle_PRE_public_pre {
    }

    chain mangle_PRE_public_log {
    }

    chain mangle_PRE_public_deny {
    }

    chain mangle_PRE_public_allow {
    }

    chain mangle_PRE_public_post {
    }

    chain filter_IN_policy_allow-host-ipv6 {
        jump filter_IN_policy_allow-host-ipv6_pre
        jump filter_IN_policy_allow-host-ipv6_log
        jump filter_IN_policy_allow-host-ipv6_deny
        jump filter_IN_policy_allow-host-ipv6_allow
        jump filter_IN_policy_allow-host-ipv6_post
    }

    chain filter_IN_policy_allow-host-ipv6_pre {
    }

    chain filter_IN_policy_allow-host-ipv6_log {
    }

    chain filter_IN_policy_allow-host-ipv6_deny {
    }

    chain filter_IN_policy_allow-host-ipv6_allow {
        icmpv6 type nd-neighbor-advert accept
        icmpv6 type nd-neighbor-solicit accept
        icmpv6 type nd-router-advert accept
        icmpv6 type nd-redirect accept
    }

    chain filter_IN_policy_allow-host-ipv6_post {
    }

    chain nat_PRE_policy_allow-host-ipv6 {
        jump nat_PRE_policy_allow-host-ipv6_pre
        jump nat_PRE_policy_allow-host-ipv6_log
        jump nat_PRE_policy_allow-host-ipv6_deny
        jump nat_PRE_policy_allow-host-ipv6_allow
        jump nat_PRE_policy_allow-host-ipv6_post
    }

    chain nat_PRE_policy_allow-host-ipv6_pre {
    }

    chain nat_PRE_policy_allow-host-ipv6_log {
    }

    chain nat_PRE_policy_allow-host-ipv6_deny {
    }

    chain nat_PRE_policy_allow-host-ipv6_allow {
    }

    chain nat_PRE_policy_allow-host-ipv6_post {
    }

    chain mangle_PRE_policy_allow-host-ipv6 {
        jump mangle_PRE_policy_allow-host-ipv6_pre
        jump mangle_PRE_policy_allow-host-ipv6_log
        jump mangle_PRE_policy_allow-host-ipv6_deny
        jump mangle_PRE_policy_allow-host-ipv6_allow
        jump mangle_PRE_policy_allow-host-ipv6_post
    }

    chain mangle_PRE_policy_allow-host-ipv6_pre {
    }

    chain mangle_PRE_policy_allow-host-ipv6_log {
    }

    chain mangle_PRE_policy_allow-host-ipv6_deny {
    }

    chain mangle_PRE_policy_allow-host-ipv6_allow {
    }

    chain mangle_PRE_policy_allow-host-ipv6_post {
    }

    chain filter_IN_docker {
        jump filter_INPUT_POLICIES_pre
        jump filter_IN_docker_pre
        jump filter_IN_docker_log
        jump filter_IN_docker_deny
        jump filter_IN_docker_allow
        jump filter_IN_docker_post
        jump filter_INPUT_POLICIES_post
        accept
    }

    chain filter_IN_docker_pre {
    }

    chain filter_IN_docker_log {
    }

    chain filter_IN_docker_deny {
    }

    chain filter_IN_docker_allow {
    }

    chain filter_IN_docker_post {
    }

    chain nat_POST_docker {
        jump nat_POSTROUTING_POLICIES_pre
        jump nat_POST_docker_pre
        jump nat_POST_docker_log
        jump nat_POST_docker_deny
        jump nat_POST_docker_allow
        jump nat_POST_docker_post
        jump nat_POSTROUTING_POLICIES_post
    }

    chain nat_POST_docker_pre {
    }

    chain nat_POST_docker_log {
    }

    chain nat_POST_docker_deny {
    }

    chain nat_POST_docker_allow {
        meta nfproto ipv4 oifname != "lo" masquerade
    }

    chain nat_POST_docker_post {
    }

    chain filter_FWD_docker {
        jump filter_FORWARD_POLICIES_pre
        jump filter_FWD_docker_pre
        jump filter_FWD_docker_log
        jump filter_FWD_docker_deny
        jump filter_FWD_docker_allow
        jump filter_FWD_docker_post
        jump filter_FORWARD_POLICIES_post
        accept
    }

    chain filter_FWD_docker_pre {
    }

    chain filter_FWD_docker_log {
    }

    chain filter_FWD_docker_deny {
    }

    chain filter_FWD_docker_allow {
        oifname "docker0" accept
        oifname "br-ae57f90864d9" accept
    }

    chain filter_FWD_docker_post {
    }

    chain nat_PRE_docker {
        jump nat_PREROUTING_POLICIES_pre
        jump nat_PRE_docker_pre
        jump nat_PRE_docker_log
        jump nat_PRE_docker_deny
        jump nat_PRE_docker_allow
        jump nat_PRE_docker_post
        jump nat_PREROUTING_POLICIES_post
    }

    chain nat_PRE_docker_pre {
    }

    chain nat_PRE_docker_log {
    }

    chain nat_PRE_docker_deny {
    }

    chain nat_PRE_docker_allow {
        ip saddr 10.0.20.120 tcp dport 40814 dnat ip to 172.20.0.2:40814
    }

    chain nat_PRE_docker_post {
    }

    chain mangle_PRE_docker {
        jump mangle_PREROUTING_POLICIES_pre
        jump mangle_PRE_docker_pre
        jump mangle_PRE_docker_log
        jump mangle_PRE_docker_deny
        jump mangle_PRE_docker_allow
        jump mangle_PRE_docker_post
        jump mangle_PREROUTING_POLICIES_post
    }

    chain mangle_PRE_docker_pre {
    }

    chain mangle_PRE_docker_log {
    }

    chain mangle_PRE_docker_deny {
    }

    chain mangle_PRE_docker_allow {
    }

    chain mangle_PRE_docker_post {
    }

    chain filter_FWD_policy_docker-forwarding {
        jump filter_FWD_policy_docker-forwarding_pre
        jump filter_FWD_policy_docker-forwarding_log
        jump filter_FWD_policy_docker-forwarding_deny
        jump filter_FWD_policy_docker-forwarding_allow
        jump filter_FWD_policy_docker-forwarding_post
        accept
    }

    chain filter_FWD_policy_docker-forwarding_pre {
    }

    chain filter_FWD_policy_docker-forwarding_log {
    }

    chain filter_FWD_policy_docker-forwarding_deny {
    }

    chain filter_FWD_policy_docker-forwarding_allow {
    }

    chain filter_FWD_policy_docker-forwarding_post {
    }

    chain nat_POST_policy_docker-forwarding {
        jump nat_POST_policy_docker-forwarding_pre
        jump nat_POST_policy_docker-forwarding_log
        jump nat_POST_policy_docker-forwarding_deny
        jump nat_POST_policy_docker-forwarding_allow
        jump nat_POST_policy_docker-forwarding_post
    }

    chain nat_POST_policy_docker-forwarding_pre {
    }

    chain nat_POST_policy_docker-forwarding_log {
    }

    chain nat_POST_policy_docker-forwarding_deny {
    }

    chain nat_POST_policy_docker-forwarding_allow {
    }

    chain nat_POST_policy_docker-forwarding_post {
    }
}

firewall-cmd --listar todas as zonas

block
  target: %%REJECT%%
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

dmz
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

docker (active)
  target: ACCEPT
  icmp-block-inversion: no
  interfaces: br-ae57f90864d9 docker0
  sources:
  services:
  ports:
  protocols:
  forward: yes
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
    rule family="ipv4" source address="10.0.20.120/32" forward-port port="40814" protocol="tcp" to-port="40814" to-addr="172.20.0.2"

drop
  target: DROP
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

external
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: ssh
  ports:
  protocols:
  forward: yes
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

home
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: cockpit dhcpv6-client mdns samba-client ssh
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

internal
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: cockpit dhcpv6-client mdns samba-client ssh
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

nm-shared
  target: ACCEPT
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcp dns ssh
  ports:
  protocols: icmp ipv6-icmp
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
    rule priority="32767" reject

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: ens192
  sources:
  services: cockpit dhcpv6-client ssh
  ports: 10050/tcp 40814/tcp
  protocols:
  forward: yes
  masquerade: yes
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
    rule family="ipv4" source address="10.0.20.120" forward-port port="40814" protocol="tcp" to-port="40814" to-addr="172.20.0.2"
    rule family="ipv4" source address="10.0.20.120" forward-port port="40814" protocol="tcp" to-port="40814" to-addr="172.17.0.2"

trusted
  target: ACCEPT
  icmp-block-inversion: no
  interfaces:
  sources:
  services:
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

work
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: cockpit dhcpv6-client ssh
  ports:
  protocols:
  forward: yes
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

WolfiG

Asked: 2024-07-18 15:54:43 +0800 CST

Não é possível conectar-se ao daemon Docker no Debian

5

Tento executar docker run hello-worldem uma máquina debian bullseye onde não tenho direitos de usuário root, mas onde posso usar arquivos sudo.

Instalei o docker (v19.03.13) de sudoacordo com a documentação do docker. docker pode ser iniciado usando sudo systemctl start dockere de acordo com sudo systemctl status dockero serviço está funcionando conforme o esperado. Também sudo systemctl status docker.socketparece normal.

Encontrei um docker.sockarquivo em /var/run/.

Agora, ao tentar executar docker run hello-world(não sudo!), Recebo uma mensagem de erro:

docker: Cannot connect to the Docker daemon at unix:///home/<myuser>/.docker/run/docker.sock. Is the docker daemon running?.

Ao que parece, o serviço docker está procurando docker.sock no diretório errado.

As seguintes coisas que eu já tentei, mas não funcionaram:

sudo systemctl stop/start/restart docker(resposta padrão que encontrei em discussões sobre este problema)
adicionei meu usuário ao grupo docker: sudo usermod -aG docker $USER. less /etc/group | grep dockerRendimentos de comandodocker:x:999:myUserName
ls -la /var/run/docker.sock-> srw-rw---- 1 root docker 0 Jul 17 17:48 /var/run/docker.sock (sugerido por https://unix.stackexchange.com/a/279785/335075 )
unset DOCKER_HOST(por exemplo, https://stackoverflow.com/a/69674630/1552080 ).
sudo mount -t cgroup -o none,name=systemd cgroup /sys/fs/cgroup/system(isso funcionou uma vez, mas não uma segunda vez depois que eu efetuei logout novamente)

O que posso fazer é correr sudo docker run hello-world.

Greg Dougherty

Asked: 2024-07-16 08:45:01 +0800 CST

Como posso comparar duas imagens do Docker?

5

Tenho duas imagens Docker, cada uma com muitas camadas. Quero comparar todos os arquivos da primeira imagem com todos os arquivos da segunda, para ver o que foi alterado.

Eu tentei tarar as imagens usando

docker image save <image no> > MyImage.tar

Mas quando eu descompacto isso, recebo mais de 100 diretórios, cada um contendo

VERSION json layer.tar

Então isso é inútil

ShadowFurtive

Asked: 2024-07-04 17:00:08 +0800 CST

Poderia usar o docker para isolamento de aplicativos?

5

Estou estudando o uso do Docker em um projeto de grande escala que é realmente implantado em produção. Nunca usei o docker antes, mas pelo que li, ele consiste em um novo layout chamado "Container Engine" que dá a oportunidade de implantar vários aplicativos independentes entre si e usar os recursos do host.

No caso em que estou trabalhando, as máquinas onde nosso aplicativo está implantado podem ter sistemas operacionais e arquiteturas diferentes; Windows, Linux, arm, Debian, etc... mas eles não possuem nenhuma VM funcionando, apenas o SO e as aplicações que implantamos.

Essas máquinas podem ter de 4 a 5 aplicações rodando no mesmo sistema, tendo cada uma delas dependências diferentes. Já tivemos alguns problemas com isso: por exemplo, com os descritores de arquivo, onde um aplicativo estava pegando a gravação de log de outro aplicativo, gerando logs errados e travando.

Estas aplicações comunicam-se com outras partes das máquinas através de sockets TCP/IP e utilizam gRPC, QPID e SFTP para comunicar com outros elementos do ambiente (servidores externos, bibliotecas próprias, etc...). Não sei se o uso desses protocolos complicaria a implementação do docker em nosso sistema.

Conversando com meus colegas de trabalho, eles me disseram que não vale a pena porque não traria nenhuma otimização ou benefício, mas acho que não.

Tenho lido que, ao usar contêineres, obtemos independência de sistema operacional, fazendo o aplicativo funcionar em sistemas operacionais diferentes usando uma imagem docker, independência de biblioteca e, portanto, isolamento entre aplicativos.

Problema com Fail2ban no meu Docker Xibo

Anexar gdb de um contêiner docker a um processo em execução em um namespace PID diferente

Por que o "dig" no rockylinux 9 não consegue encontrar um contêiner/host chamado "https" em uma rede docker compose?

driver de registro syslog dando erro protocolo tipo errado para soquete

cgroup memory.max é substituído pelo docker

Examinar procfs para contêiner baseado em scratch

Roteando o tráfego para o contêiner docker a partir de um IP de origem específico

Não é possível conectar-se ao daemon Docker no Debian

Como posso comparar duas imagens do Docker?

Poderia usar o docker para isolamento de aplicativos?

Possível firmware ausente /lib/firmware/i915/* para o módulo i915

Falha ao buscar o repositório de backports jessie

Como exportar uma chave privada GPG e uma chave pública para um arquivo

Como podemos executar um comando armazenado em uma variável?

Como configurar o systemd-resolved e o systemd-networkd para usar o servidor DNS local para resolver domínios locais e o servidor DNS remoto para domínios remotos?

apt-get update error no Kali Linux após a atualização do dist [duplicado]

Como ver as últimas linhas x do log de serviço systemctl

Nano - pule para o final do arquivo

erro grub: você precisa carregar o kernel primeiro

Como baixar o pacote não instalá-lo com o comando apt-get?

Perguntas[docker](unix)