github/linuxkit
1
0
Fork 0
mirror of https://github.com/linuxkit/linuxkit.git synced 2025-07-20 17:49:10 +00:00
Code Issues Projects Releases Wiki Activity

Improve Wireguard example with more realistic setup

Browse Source 
This creates two containers connected over a Wireguard tunnel.

From the `getty` container that comes up you can connect to the
Nginx server via an encrypted tunnel with
```
wget -O - http://192.168.2.1
```

You can use `nsenter` to check out the other namespaces. There is no
external connectivity in either the `getty` or `nginx` containers,
so the only available networking is through the wireguard tunnel.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
This commit is contained in:
Justin Cormack 2017-08-22 11:57:45 +01:00
parent 584613cddb
commit 6e2e9d7049
1 changed files with 31 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
examples/wireguard.yml
View File

@ -12,30 +12,43 @@ onboot:
- name: dhcpcd - name: dhcpcd
image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7 image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"] command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
- name: wg - name: wg0
image: linuxkit/ip:4ce3b47fef3a9d5c78ae45e2946c9fdf95af2fa5 image: linuxkit/ip:b084fd2ada446015e00e43a441bb0ae41ff8b227
net: new net: new
binds: binds:
- /etc/wireguard:/etc/wireguard - /etc/wireguard:/etc/wireguard
command: ["sh", "-c", "ip link set dev wg0 up; ip address add dev wg0 192.168.2.1 peer 192.168.2.2; wg setconf wg0 /etc/wireguard/wg0.conf; wg show wg0"] command: ["sh", "-c", "ip link set dev wg0 up; ip address add dev wg0 192.168.2.1/24; wg setconf wg0 /etc/wireguard/wg0.conf; wg show wg0"]
runtime: runtime:
interfaces: interfaces:
- name: wg0 - name: wg0
add: wireguard add: wireguard
createInRoot: true createInRoot: true
bindNS: bindNS:
net: /run/netns/wg net: /run/netns/wg0
- name: wg1
image: linuxkit/ip:b084fd2ada446015e00e43a441bb0ae41ff8b227
net: new
binds:
- /etc/wireguard:/etc/wireguard
command: ["sh", "-c", "ip link set dev wg1 up; ip address add dev wg1 192.168.2.2/24; wg setconf wg1 /etc/wireguard/wg1.conf; wg show wg1"]
runtime:
interfaces:
- name: wg1
add: wireguard
createInRoot: true
bindNS:
net: /run/netns/wg1
services: services:
- name: getty - name: getty
image: linuxkit/getty:797cb79e0a229fcd16ebf44a0da74bcec03968ec image: linuxkit/getty:797cb79e0a229fcd16ebf44a0da74bcec03968ec
env: env:
- INSECURE=true - INSECURE=true
net: /run/netns/wg net: /run/netns/wg1
- name: rngd - name: rngd
image: linuxkit/rngd:558e86a36242bb74353bc9287b715ddb8567357e image: linuxkit/rngd:558e86a36242bb74353bc9287b715ddb8567357e
- name: nginx - name: nginx
image: nginx:alpine image: nginx:alpine
net: /run/netns/wg net: /run/netns/wg0
capabilities: capabilities:
- CAP_NET_BIND_SERVICE - CAP_NET_BIND_SERVICE
- CAP_CHOWN - CAP_CHOWN
@ -46,11 +59,21 @@ files:
- path: etc/wireguard/wg0.conf - path: etc/wireguard/wg0.conf
contents: | contents: |
[Interface] [Interface]
PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk= PrivateKey = KG7EKkHDkp7THfW5mOXcZzo3RbGAjq+ARMfJGFm5G1s=
ListenPort = 51820 ListenPort = 51820
[Peer] [Peer]
PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg= PublicKey = ZP7h1OjA1oIAmsAvMKujp2RAAC/f0kY814b3Xq6j/0Y=
AllowedIPs = 0.0.0.0/0 AllowedIPs = 0.0.0.0/0
Endpoint = 127.0.0.1:51821
- path: etc/wireguard/wg1.conf
contents: |
[Interface]
PrivateKey = SCGCKDuTm4PMOw+LXdK/2s8mxnv145QHOohKRq3vc2A=
ListenPort = 51821
[Peer]
PublicKey = AcS5t3PC5nL/oj0sYhc3yFpDlRaXoJ0mfEq6iq0rFF4=
AllowedIPs = 0.0.0.0/0
Endpoint = 127.0.0.1:51820
trust: trust:
org: org:
- linuxkit - linuxkit