Improve Wireguard example with more realistic setup

This creates two containers connected over a Wireguard tunnel.

From the `getty` container that comes up you can connect to the
Nginx server via an encrypted tunnel with
```
wget -O - http://192.168.2.1
```

You can use `nsenter` to check out the other namespaces. There is no
external connectivity in either the `getty` or `nginx` containers,
so the only available networking is through the wireguard tunnel.

Signed-off-by: Justin Cormack <justin.cormack@docker.com>
This commit is contained in:
Justin Cormack 2017-08-22 11:57:45 +01:00
parent 584613cddb
commit 6e2e9d7049

View File

@ -12,30 +12,43 @@ onboot:
- name: dhcpcd
image: linuxkit/dhcpcd:f3f5413abb78fae9020e35bd4788fa93df4530b7
command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
- name: wg
image: linuxkit/ip:4ce3b47fef3a9d5c78ae45e2946c9fdf95af2fa5
- name: wg0
image: linuxkit/ip:b084fd2ada446015e00e43a441bb0ae41ff8b227
net: new
binds:
- /etc/wireguard:/etc/wireguard
command: ["sh", "-c", "ip link set dev wg0 up; ip address add dev wg0 192.168.2.1 peer 192.168.2.2; wg setconf wg0 /etc/wireguard/wg0.conf; wg show wg0"]
command: ["sh", "-c", "ip link set dev wg0 up; ip address add dev wg0 192.168.2.1/24; wg setconf wg0 /etc/wireguard/wg0.conf; wg show wg0"]
runtime:
interfaces:
- name: wg0
add: wireguard
createInRoot: true
bindNS:
net: /run/netns/wg
net: /run/netns/wg0
- name: wg1
image: linuxkit/ip:b084fd2ada446015e00e43a441bb0ae41ff8b227
net: new
binds:
- /etc/wireguard:/etc/wireguard
command: ["sh", "-c", "ip link set dev wg1 up; ip address add dev wg1 192.168.2.2/24; wg setconf wg1 /etc/wireguard/wg1.conf; wg show wg1"]
runtime:
interfaces:
- name: wg1
add: wireguard
createInRoot: true
bindNS:
net: /run/netns/wg1
services:
- name: getty
image: linuxkit/getty:797cb79e0a229fcd16ebf44a0da74bcec03968ec
env:
- INSECURE=true
net: /run/netns/wg
net: /run/netns/wg1
- name: rngd
image: linuxkit/rngd:558e86a36242bb74353bc9287b715ddb8567357e
- name: nginx
image: nginx:alpine
net: /run/netns/wg
net: /run/netns/wg0
capabilities:
- CAP_NET_BIND_SERVICE
- CAP_CHOWN
@ -46,11 +59,21 @@ files:
- path: etc/wireguard/wg0.conf
contents: |
[Interface]
PrivateKey = yAnz5TF+lXXJte14tji3zlMNq+hd2rYUIgJBgB3fBmk=
PrivateKey = KG7EKkHDkp7THfW5mOXcZzo3RbGAjq+ARMfJGFm5G1s=
ListenPort = 51820
[Peer]
PublicKey = xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=
PublicKey = ZP7h1OjA1oIAmsAvMKujp2RAAC/f0kY814b3Xq6j/0Y=
AllowedIPs = 0.0.0.0/0
Endpoint = 127.0.0.1:51821
- path: etc/wireguard/wg1.conf
contents: |
[Interface]
PrivateKey = SCGCKDuTm4PMOw+LXdK/2s8mxnv145QHOohKRq3vc2A=
ListenPort = 51821
[Peer]
PublicKey = AcS5t3PC5nL/oj0sYhc3yFpDlRaXoJ0mfEq6iq0rFF4=
AllowedIPs = 0.0.0.0/0
Endpoint = 127.0.0.1:51820
trust:
org:
- linuxkit