use ssh port forwarding to expose host's ports to the containers #806

bsideup · 2018-07-28T15:46:55Z

// tell Testcontainers which host ports to expose to your containers
Testcontainers.exposeHostPorts(someHostPortNumber);

// later, just give your container this address to use to reach back to the host:
address = "http://host.testcontainers.internal:" + someHostPortNumber;

rnorth

This is pretty awesome, nice work!

I assume we are OK regarding security - this will not be accessible on any real external (LAN) network, will it?

We can update the docs after releasing. I think this will warrant some major examples updates too :)

rnorth · 2018-07-29T19:10:15Z

core/src/main/java/org/testcontainers/containers/GenericContainer.java

            containerId = createCommand.exec().getId();
+
+            PortForwardingContainer.INSTANCE.getNetwork().map(ContainerNetwork::getNetworkID).ifPresent(networkId -> {
+                if (!Arrays.asList(networkId, "none", "host").contains(createCommand.getNetworkMode())) {


Ah good, does this prevent the sshd container being connected to the host network?

Obviously it would be bad to let this thing be accessible on real networks 😬

host & none networks are not connectable, this is why I added it :)

We could also use a random password to improve the security

If adding a random password isn't a massive change, let's do it. I can't think of a practical attack via this container, but we may as well just in case we've missed something.

changed to generate a random password

kiview

Really love this feature, already thinking about how to refactor some of our tests at work, which are hardcoded interacting with the Linux host network.

kiview · 2018-08-02T13:54:27Z

core/src/main/java/org/testcontainers/containers/PortForwardingContainer.java

+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+
+public enum PortForwardingContainer {


What's the reason to use an Enum here and not a Singleton? Maybe I'm missing something obvious, or do we use this approach elsewhere as well?

that's the easiest way to achieve singleton in JVM, used by Spring and others.

https://dzone.com/articles/java-singletons-using-enum

Okay, I didn't know this, nice I could learn something new 😄

kiview · 2018-08-03T09:18:21Z

core/src/main/java/org/testcontainers/containers/PortForwardingContainer.java

+    @SneakyThrows
+    public void exposeHostPort(int port) {
+        if (exposedPorts.add(port)) {
+            getSshConnection().requestRemotePortForwarding("", port, "localhost", port);


This method of the ssh lib is so cool 😎

kiview · 2018-08-03T09:20:27Z

core/src/main/java/org/testcontainers/containers/GenericContainer.java


    public static final int CONTAINER_RUNNING_TIMEOUT_SEC = 30;

+    public static final String INTERNAL_HOST_HOSTNAME = "host.testcontainers.internal";


Maybe better, to use host.testcontainers here?

While the .internal TLD is technically 'wrong' to use, I can't actually find an official TLD that is properly reserved and semantically correct.

Given that Docker is host.docker.internal, I feel it's OK to follow in their tracks and keep host.testcontainers.internal.

K, makes sense to be similar to Docker.

kiview · 2018-08-03T09:25:25Z

core/src/main/java/org/testcontainers/containers/GenericContainer.java


            containerId = createCommand.exec().getId();
+
+            PortForwardingContainer.INSTANCE.getNetwork().map(ContainerNetwork::getNetworkID).ifPresent(networkId -> {


WDYT about refactoring to private method for better readibility? Took me some time to get the high level view what's happening here (and I possibly even got it wrong):

[...] String networkMode = createCommand.getNetworkMode(); connectToPortForwardingNetwork(networkMode); [...] private void connectToPortForwardingNetwork(String networkMode) { PortForwardingContainer.INSTANCE.getNetwork().map(ContainerNetwork::getNetworkID).ifPresent(networkId -> { if (!Arrays.asList(networkId, "none", "host").contains(networkMode)) { dockerClient.connectToNetworkCmd().withContainerId(containerId).withNetworkId(networkId).exec(); } }); }

👍 yes, I think that would help the readability.

@kiview extracted

kiview · 2018-08-03T09:29:23Z

core/src/main/java/org/testcontainers/containers/PortForwardingContainer.java

+    }
+
+    Optional<ContainerNetwork> getNetwork() {
+        return Optional.ofNullable(container)


I think we have the same exact code multiple times in our code base, so we could add a utility method for this? (not in this PR).

Optional<ContainerNetwork> getFirstNetwork() in GenericContainer?

this code doesn't have any logic in it (and just calls the getters), but exposing it as public API (in Testcontainers) makes me feel uneasy, I would rather not do that

kiview · 2018-08-03T09:34:20Z

@rnorth AFAIK the SSH server is only available to Docker networks, if I understood the implementation correctly?

rnorth · 2018-08-05T14:58:20Z

@kiview yep, that makes perfect sense.

rnorth · 2018-09-10T08:24:58Z

We have this out in a Release Candidate build (1.9.0-rc1) for anyone who is keen to try it!

Release notes

bsideup requested review from kiview and rnorth July 28, 2018 15:46

bsideup added this to the next milestone Jul 28, 2018

bsideup added the type/feature label Jul 28, 2018

bsideup added 3 commits July 28, 2018 17:57

use ssh port forwarding to expose host's ports to the containers

fd054f2

make the test more readable

e986df1

fix shading

f71c2bc

bsideup force-pushed the expose_host_ports branch from 4f30096 to f71c2bc Compare July 28, 2018 15:58

bsideup added 2 commits July 28, 2018 19:10

hide sshConnection from public API

efbe806

use withExtra hosts, do not connect "none" or "host" networks

1e09fb9

rnorth reviewed Jul 29, 2018

View reviewed changes

bsideup removed this from the next milestone Jul 30, 2018

use random password

981e131

bsideup added this to the next milestone Jul 31, 2018

kiview reviewed Aug 3, 2018

View reviewed changes

bsideup modified the milestones: 1.8.3, next Aug 6, 2018

extract connectToPortForwardingNetwork method

94e011d

bsideup merged commit dabe7da into master Aug 16, 2018

bsideup deleted the expose_host_ports branch August 16, 2018 13:29

kiview removed this from the 1.9.0-rc1 milestone Jun 17, 2022


		public static final int CONTAINER_RUNNING_TIMEOUT_SEC = 30;

		public static final String INTERNAL_HOST_HOSTNAME = "host.testcontainers.internal";


		containerId = createCommand.exec().getId();

		PortForwardingContainer.INSTANCE.getNetwork().map(ContainerNetwork::getNetworkID).ifPresent(networkId -> {

Uh oh!

use ssh port forwarding to expose host's ports to the containers #806

use ssh port forwarding to expose host's ports to the containers #806

Uh oh!

Conversation

bsideup commented Jul 28, 2018 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rnorth left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kiview left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kiview commented Aug 3, 2018

Uh oh!

rnorth commented Aug 5, 2018

Uh oh!

rnorth commented Sep 10, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

bsideup commented Jul 28, 2018 •

edited

Loading