This is a bit of a personal project however I felt it highlighted the power of Docker, specifically around the fact you can ship your application with underlying OS level dependencies in a container, even if your target host has a different version. I'm sure you can realise the power there of being able to ship OS dependencies with your app, thus guaranteeing compatibility with any host that can run a Docker container.
In this particular example I am needing to connect to an IKE VPN which was presenting itself with a rather old 1024bit certificate. Now it's widely accepted that 2048bit should be the minimum, and all of a sudden after a recent openssl and IKE update on my machine I was no longer able to connect to IKE VPNs where the servers CA certificate was 1024bit. Unfortunately the end point I was connecting to had no intention of updating their certificates and time soon, and I wasn't going to downgrade my openssl version just to support their outdated endpoint - and herein lies the power of containers.
Docker is effectively Chroot on steroids, but fundamentally we create a filesystem which we executed programs within, and they can only access the filesystem within that "chrooted" jail. In means we can definitively control which versions of libraries our applications use. In this case, we're wanting to create a chroot jail which contains a version of openssl which allows us to connect to 1024bit endpoints.
When I say, "Chroot on steroids", it wraps all the aspects of creating the jail in a nice little Dockerfile syntax. Below is the Dockerfile I use to basically use
centos 6 as a base, I downgrade openssl to
1.0.1e-30, I install the dependencies for
iked/c, and then set the entrypoint of the container (what to run when the container starts):
FROM centos:6 MAINTAINER Karl Stoney <[email protected]> ENV MALLOC_CHECK_ 0 ENV LD_LIBRARY_PATH /usr/lib RUN yum -y install openssl-devel RUN yum -y downgrade openssl-1.0.1e-30.el6_6.4 openssl-devel-1.0.1e-30.el6_6.4 RUN yum -y install wget tar cmake gcc gcc-c++ libedit-devel flex bison RUN cd /tmp && \ wget https://www.shrew.net/download/ike/ike-2.2.1-release.tgz && \ tar -xzf ike-* && \ cd ike* && \ cmake -DCMAKE_INSTALL_PREFIX=/usr -DQTGUI=NO -DETCDIR=/etc -DNATT=YES && \ make && \ make install && \ make install && \ rm -rf /tmp/ike* RUN mv /etc/iked.conf.sample /etc/iked.conf VOLUME /sites WORKDIR /sites COPY start-iked.sh /usr/local/bin/start-iked.sh ENTRYPOINT ["/usr/local/bin/start-iked.sh"]
You can see the full project on my github at https://github.com/Stono/ike
Using the container
If you actually have a use for this container, I've already published it to the Docker Registry so you simply type:
docker run --rm -it --privileged --net=host -v ~/.ike/sites:/sites stono/ike SiteName Username Password
What we're doing here is mounting in our local
~/.ike/sites directory into
/sites in the container, starting the site
SiteName with the user
Username and the password
Password. What you should get when you run the command, is a successful VPN connection:
IKEd started. Starting IKEc for SiteName... ii : ## : VPN Connect, ver 2.2.1 ## : Copyright 2013 Shrew Soft Inc. ## : press the <h> key for help >> : config loaded for site 'EMEA' >> : attached to key daemon ... ii : created ike socket 0.0.0.0:500 ii : created natt socket 0.0.0.0:4500 ## : IKE Daemon, ver 2.2.1 ## : Copyright 2013 Shrew Soft Inc. ## : This product linked OpenSSL 1.0.1e-fips 11 Feb 2013 >> : peer configured >> : iskamp proposal configured >> : esp proposal configured >> : client configured >> : local id configured >> : remote id configured >> : server cert configured K! : recv X_SPDDUMP message failure ( errno = 2 ) ii : bringing up tunnel ... !! : peer violates RFC, transform number mismatch ( 1 != 14 ) !! : phase1 packet ignored, resending last packet ( phase1 already mature ) !! : phase1 packet ignored, resending last packet ( phase1 already mature ) >> : network device configured !! : config packet ignored ( config already mature ) ii : tunnel enabled !! : config packet ignored ( config already mature ) !! : peer violates RFC, transform number mismatch ( 1 != 32 ) ^CDetected SIGTERM, shuting down... Stopping ikec... Stopping iked...