#Docker create ssh tunnel full#

#Docker create ssh tunnel full#

Try doing that with Xen, and unless you have a really big host, I don't think it is possible.Ī full virtualized system usually takes minutes to start, whereas Docker/LXC/runC containers take seconds, and often even less than a second. So you could easily run thousands of containers on a host, and it won't even blink.

With Docker you get less isolation, but the containers are lightweight (require fewer resources). You get more isolation, but it is much heavier (requires more resources). With Docker and AuFS you can share the bulk of the 1 GB between all the containers and if you have 1000 containers you still might only have a little over 1 GB of space for the containers OS (assuming they are all running the same OS image).Ī full virtualized system gets its own set of resources allocated to it, and does minimal sharing. So, let's say you have a 1 GB container image if you wanted to use a full VM, you would need to have 1 GB x number of VMs you want. One could have the common parts of the operating system as read only (and shared amongst all of your containers) and then give each container its own mount for writing. Also, it uses a layered filesystem ( AuFS) and manages networking.ĪuFS is a layered file system, so you can have a read only part and a write part which are merged together. This allows it to share a lot of the host operating system resources. So within your docker containers just channel the traffic to different ports of your docker0 bridge and then create several ssh tunnel commands (one for each port you are listening to) that intercept data at these ports and then forward it to the different hosts and hostports of your choice.ĭocker originally used LinuX Containers (LXC), but later switched to runC (formerly known as libcontainer), which runs in the same operating system as its host. Within your ssh tunnel command ( ssh -L port:host:hostport] the port part of the bind_address does not have to match the hostport of the host and, therefore, can be freely chosen by you. a docker container needs to connect to multiple remote DB's via tunnel), several valid techniques exist but an easy and straightforward way is to simply create multiple tunnels listening to traffic arriving at different docker0 bridge ports.

When dealing with multiple outgoing connections (e.g. Now traffic being routed through your docker0 bridge will also reach your ssh tunnel :)įor example, if you have a 'DOT.NET Core' application that needs to connect to a remote db located at :9000, your 'ConnectionString' would contain 'server=172.17.0.1,9000. In your containerized application use the same docker0 ip to connect to the server: 172.17.0.1:9000. Side note: You could also bind your tunnel to 0.0.0.0, which will make ssh listen to all interfaces. Without setting the bind_address, :9000 would only be available to your host's loopback interface and not per se to your docker containers.

Now you need to tell ssh to bind to this ip to listen for traffic directed towards port 9000 via ssh -L 172.17.0.1:9000:host-ip:9999 You will see something like this: docker0 Link encap:Ethernet HWaddr 03:41:4a:26:b7:31 by binding ssh to the docker0 bridge) instead of exposing your docker containers in your host environment (as suggested in the accepted answer).įor this to work, retrieve the ip your docker0 bridge is using via: ifconfig In your case, a quick and cleaner solution would be to make your ssh tunnel 'available' to your docker containers (e.g. Using your hosts network as network for your containers via -net=host or in docker-compose via network_mode: host is one option but this has the unwanted side effect that (a) you now expose the container ports in your host system and (b) that you cannot connect to those containers anymore that are not mapped to your host network. I also tried mapping the ports via docker run -p 9999:9000, but this reports that the bind failed because the host port is already in use (from the host tunnel to the remote machine, presumably).ġ – How will I achieve the connection? Do I need to setup an ssh tunnel to the host, or can this be achieved with the docker port mapping alone?Ģ – What's a quick way to test that the connection is up? Via bash, preferably. 2 but there was no perceived communication, even when doing To check wether the port mapping was on, I triedįollowing this, parag. I tried tunneling from the container to the host with -L 9000:host-ip:9999, then accessing the service through 127.0.0.1:9000 from within the container fails to connect. I need to access that remote service via the host's tunnel, from within the container. Using ubuntu tusty, there is a service running on a remote machine, that I can access via port forwarding through an ssh tunnel from localhost:9999.