Bind socat to 127.0.0.1 when using it on OS X #11139
Conversation
|
@smarterclayton ptal |
|
also @bparees |
|
lgtm [merge] |
|
[Test]ing while waiting on the merge queue |
| @@ -63,7 +63,7 @@ func (h *Helper) startSocatTunnel() error { | |||
| if err != nil { | |||
| glog.V(1).Infof("error: cannot kill socat: %v", err) | |||
| } | |||
| cmd := exec.Command("socat", "TCP-L:8443,reuseaddr,fork,backlog=20", "SYSTEM:\"docker exec -i origin socat - TCP\\:localhost\\:8443,nodelay\"") | |||
| cmd := exec.Command("socat", "TCP-L:8443,reuseaddr,fork,backlog=20,bind=127.0.0.1", "SYSTEM:\"docker exec -i origin socat - TCP\\:localhost\\:8443,nodelay\"") | |||
There was a problem hiding this comment.
Is this code path only used in Docker for Mac? If I am on Mac, but pointing to a remote host, will this get called?
|
Thanks On Wed, Sep 28, 2016 at 12:21 PM, Cesar Wong [email protected]
|
|
Flake #11015 |
|
Flake #11015 |
|
#11016 |
|
Evaluated for origin merge up to 44ef3ad |
|
Evaluated for origin test up to 44ef3ad |
|
continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/9475/) (Image: devenv-rhel7_5101) |
|
continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pr_origin/9475/) |
On OS X using Docker for Mac, it is not possible to access the Docker VM directly via host IP (this is not the case with Windows). The workaround we use in cluster up is to start a socat bridge that will listen on the Mac's local interface and forward traffic to the origin container.
Until now, the socat process has been bound to all interfaces on the Mac. This exposes the OpenShift master endpoint to the external world. It's not the case when using docker-machine because the vm's IP is only accessible to the Mac. This change makes it so the socat process on the Mac will only bind to 127.0.0.1.
The router ip is still based on the default IP of the Mac and routes for applications running on OpenShift on the Mac will still be visible to the outside world.