Home / ubuntu / Questions / 792578
Accepted
user3498780
Asked: 2016-06-29 19:18:37 +0800 CST

How to redirect ssh logins to server's Docker containers

  • 772

I'm planning a server for the students studying Linux and have some rules for this.

  1. All students will get the same server domain/port for SSH, and each own username/password(normal privilege).

  2. 4 servers will be clustered, and for all users not an admin it will redirect to each own Docker*.

  3. All students will be able to access to the server through the internal network using a SSH client.

The problem is very simple, "how to access to the designated docker using SSH with the same domain/port for each user". It clearly means the server will have to redirect SSH requests to each own Docker depending only on usernames.

The final goal is that all students can write and build their programs on the Linux environment through Bash shell, and do pretty much everything else within the SSH session.

I have read various Docker and SSH documents but not been able to find an appropriate solution. Any help will be appreciated :).

PS.

While it's possible that it's XY problem, the reason why I want this because I don't want the server ruined by a single user. So you can suggest another way to acquire this requirement, of course.

networking

2 Answers

  1. Best Answer

    A similar question was asked that might answer your question:

    Consider using a ForceCommand directive in sshd_config. For example, I use these to force groups of users to a set of servers:

    Match Group group1
       ForceCommand ssh -t group1.fqdn

Match Group="*,!local,!group2,!root"
       ForceCommand ssh -t group3.fqdn

    You could use:

    Match User foo
    ForceCommand ssh -t target-host

    I've never used this, but a set of directives, one for each user, could make the "SSH gateway" you're proposing.

    • 3

  2. I'd rather use KVM and ansible/saltstack/puppet and have a master snapshot VM.

    The KVM hypervisor is as clever as dokcer and makes sure that every vm doesn't get all the ressources even if one VM tries to go nuts. No need to worry about troubleshooting memory hogs, permission problems, CPU. You can even overcommit like you could with docker, that's so cool.

    • you can control every VM through a single GUI tool
    • you snapshot a golden image and copy it to every machine at the first day
    • every machine has it's own (bridged) unique ip address
    • every VM can be shutdown/stopped/restarted over GUI or ssh

    kvm works great on cli but also has some small gui tools, where you can easily get hold of the root console in no time and also see the ressources used of every virtual machine on one screen. its rudimentary, but works very well.

    To automate processes you can use tools like ansible or saltstack. so you could e.g.

    • add further content onto the running vm's easily
    • you could store away the snapshots
    • revoke user rights or permissions on every or a single vm
    • stop a or all vm with an ansible command
    • update the golden image and spread it to all machines again
    • (re)move or copy a or all images
    • save a or all images
    • add individual users on the fly
    • add individual packets on the fly
    • snapshot a or all vm's

    Why not docker? Docker is great, I use it too. Docker was meant to be "read-only" and to serve content to customers. This doesn't quite fit the bill?

    But remember, there is

    • the internal docker network
    • there is the docker registry, which needs to be held clean
    • If you don't attach another data container, then the changes are gone if you update
    • Also you have to worry about cgroups and namespaces

    The VM behaves like a normal system and there is no easy way to hide for the student, because he has a definite IP adress given to him/her.

    As HDD space is one of the lowest costs when it comes to server, I'd rather buy an additional master server or PC/laptop and use it to take full control over the 4 servers, which then run X VM's, each with it's own unique IP and/or even DNS name.

    To set this up is more work, but I'd say you have also far more control over the servers and also over your students, because you have direct access to the VM.

    Once everything is in place you can control your course from start to end with a few tools and ansible commands (or similar tool).

    Oh, and if you add MAAS plus PXE boot to this setup, you would even be prepared for a server loss/replacement, just put in the new machine setup pxe, boot, be happy.

    Here you can see a simple setup which will get you started.

    • 0