tg123/sshpiper

Random ssh connection failures when container has multiple networks in docker plugin

sinbino opened this issue · 3 comments

If the target sshd server container is connected to multiple docker networks, sshpiperd may attempt to make an ssh connection to an IP on an unconnected network and the connection may fail.

docker-compose.yml example (This is a simplification for illustrative purposes and does not work as is.)

services:
  main:
    image: my-sshd-server
    networks:
      - default             // 172.18.0.2 (172.18.0.0/16)
      - sshpiperd-network   // 172.19.0.2 (172.19.0.0/16)
    labels:
      - sshpiper.username=you
      - sshpiper.container_username=you
      - sshpiper.authorized_keys=$AUTHORIZED_KEYS_BASE64
      - sshpiper.private_key=$PRIVATE_KEY_BASE64
  sub:
    image: my-other-server
    networks:
      - default             // 172.18.0.3 (172.18.0.0/16)

networks:
  sshpiperd-network:        // (172.19.0.0/16)
    external: true

In the above pattern, sshpiperd with docker plugin is trying to connect to 172.18.0.2 or 172.19.0.2 (perhaps randomly?).
If 172.19.0.2 is chosen, the connection succeeds, but if 172.18.0.2 is chosen, the connection fails after a timeout.

Perhaps in the listPipes function in plugin/docker/docker.go, around line 71, it would be nice to filter network to only those that can be connected to from sshpiperd.
However, I am not familiar with the go language and docker API in depth and did not know where to get the docker network name that sshpiperd is connected to.

Thank you for creating this excellent project!

tg123 commented

proposal: introducing sshpiper.network in labels
thus, you can set it to sshpiperd-network

I think it is great.
Thanks for the quick response!

tg123 commented

update: multiple networks without explicit specify sshpiper.network is now an error.