tart run: introduce --net-softnet-expose #990
Conversation
Sources/tart/Commands/Run.swift
Outdated
| @@ -190,6 +190,9 @@ struct Run: AsyncParsableCommand { | |||
| @Option(help: ArgumentHelp("Comma-separated list of CIDRs to allow the traffic to when using Softnet isolation\n(e.g. --net-softnet-allow=192.168.0.0/24)", valueName: "comma-separated CIDRs")) | |||
| var netSoftnetAllow: String? | |||
|
|
|||
| @Option(help: ArgumentHelp("Comma-separated list of TCP ports to expose (e.g. --net-softnet-expose 2222:22,8080:80)", valueName: "comma-separated port specifications")) | |||
There was a problem hiding this comment.
Will it be exposed on the tart ip address? Where should a service inside guest to bind on? 0.0.0.0? 127.0.0.1?
There was a problem hiding this comment.
Will it be exposed on the
tart ipaddress?
It will be exposed on all egress network interfaces.
Where should a service inside guest to bind on?
0.0.0.0?127.0.0.1?
0.0.0.0.
Basically port forwarding in vmnet works by just installing PF rules.
For example, with --net-softnet-expose 2222:22,8080:80, one will get this:
rdr on en0 inet proto tcp from any to (en0:0) port = 2222 -> 192.168.67.2 port 22
rdr on en0 inet proto tcp from any to (en0:0) port = 8080 -> 192.168.67.2 port 80
...where 192.168.67.2 is the VMs IP (as returned by tart ip).
There was a problem hiding this comment.
Can we add a discussion explaining the example above.
Something like that service running on 0.0.0.0:22 inside the VM will on on 0.0.0.0:2222 and 127.0.0.1:22222 on host.
Out users mostly like I am and might not have that deep of understanding how prt forwarding usually works.
There was a problem hiding this comment.
It works similarly to docker run -p and kubectl port-forward, but I'll see what I can do about this.
There was a problem hiding this comment.
Added discussion in d5c96aa.
...and how to disable them.
That would be |
|
No |
It depends on where you're planning to access the exposed port from. If it's from the internet — then |
And how --net-softnet-allow can change that behavior.
Softnet's side: cirruslabs/softnet#70.
Note that Softnet limitations still apply. This means that for exposing the VMs ports to the LAN, you might probably want to add something like
--net-softnet-allow=192.168.0.0/24or use--net-softnet-allow=0.0.0.0/0if you don't need Softnet protection.See #855.