Skip to content

Chore: Refactor Docker stuff#237

Open
zonescape wants to merge 1 commit intodndx:mainfrom
zonescape:docker
Open

Chore: Refactor Docker stuff#237
zonescape wants to merge 1 commit intodndx:mainfrom
zonescape:docker

Conversation

@zonescape
Copy link
Copy Markdown

This PR adds some improvements to Docker stuff. The main goal is to run phantun under unprivileged user and to use the default bridge network.

docker-compose.yml

  • drop version field. It isn't used by modern Docker.
  • drop fields that are unnecessary for the example (container_name, restart)
  • don't use host network
  • don't run in privileged mode
  • change port numbers to those used in README
  • use lowercase RUST_LOG value
  • add UDP echo service as an example backend. This is very convenient for testing.

Dockerfile

  • don't use latest as base image version
  • change base image for runtime from debian to debian-slim to reduce image size
  • drop dead code
  • add net_admin capability to phantun executables to be run by unprivileged user
  • move package installation before copying executables for better Docker build cache usage
  • add unprivileged user
  • use lowercase RUST_LOG value

.dockerignore

  • change file name to Dockerfile.dockerignore. Current .dockerignore file isn't used by Docker.
  • fix file patterns

phantun.sh

  • move sysctls to docker-compose.yml. This is the usual place for them. Setting them in the entrypoint requires additional capabilities.
  • run phantun under unprivileged user

Notes:

  • I test image and compose file in the IPv4 mode
  • I didn't test them in the IPv6 mode

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant