Random ssh connection failures when container has multiple networks in docker plugin
sinbino opened this issue · 3 comments
If the target sshd server container is connected to multiple docker networks, sshpiperd may attempt to make an ssh connection to an IP on an unconnected network and the connection may fail.
docker-compose.yml example (This is a simplification for illustrative purposes and does not work as is.)
services:
main:
image: my-sshd-server
networks:
- default // 172.18.0.2 (172.18.0.0/16)
- sshpiperd-network // 172.19.0.2 (172.19.0.0/16)
labels:
- sshpiper.username=you
- sshpiper.container_username=you
- sshpiper.authorized_keys=$AUTHORIZED_KEYS_BASE64
- sshpiper.private_key=$PRIVATE_KEY_BASE64
sub:
image: my-other-server
networks:
- default // 172.18.0.3 (172.18.0.0/16)
networks:
sshpiperd-network: // (172.19.0.0/16)
external: true
In the above pattern, sshpiperd with docker plugin is trying to connect to 172.18.0.2 or 172.19.0.2 (perhaps randomly?).
If 172.19.0.2 is chosen, the connection succeeds, but if 172.18.0.2 is chosen, the connection fails after a timeout.
Perhaps in the listPipes function in plugin/docker/docker.go, around line 71, it would be nice to filter network to only those that can be connected to from sshpiperd.
However, I am not familiar with the go language and docker API in depth and did not know where to get the docker network name that sshpiperd is connected to.
Thank you for creating this excellent project!
proposal: introducing sshpiper.network
in labels
thus, you can set it to sshpiperd-network
I think it is great.
Thanks for the quick response!
update: multiple networks without explicit specify sshpiper.network
is now an error.