Docker，PHP-FPM，MySql：使用ssh隧道从容器连接到远程数据库

Question

We've recently moved our php api to a docker container and I am trying to connect to a remote DB that requires an ssh tunnel. I've searched and can't find a workable answer, perhaps I'm trying to cut corners, I'm not sure. New at this.

When I connect to the db via my mysql gui client, the ssh tunnel requires just a password, not a public key. Although I've read it's not the most secure way to do it, I am using sshpass in my build.

We're using Aura/SQL as a PDO library and it makes its connection when the container config is run. When it was on the same server it worked fine from inside the api. I'm not sure how Aura will know about the ssh connection.

Here is my Dockerfile:

# version
FROM php:7.2.3-fpm

RUN apt-get update && \
    apt-get install -y procps git libssh2-1 libssh2-1-dev sshpass && \
    pecl install ssh2-1.1.2 && \
    docker-php-ext-enable ssh2 && \
    docker-php-ext-install pdo pdo_mysql && \
    sshpass -p 'XXXXXXXXX' ssh -o StrictHostKeyChecking=no -L 3306:localhost:3306 username@mysite.com

WORKDIR ./api
ADD ./ ./

ADD ./www.conf /usr/local/etc/php-fpm.d/www.conf

On build I don't get any errors, just a warning that known_hosts was updated and that a terminal was not open, some to that effect.

When I try to hit an endpoint that requires the db connection I get:

SQLSTATE[HY000] [2002] Connection refused

Am what I'm trying to do possible, or do I need a separate container, something like this: https://hub.docker.com/r/kingsquare/tunnel/ or https://docs.docker.com/samples/library/mysql/

Thanks - D

Answer 1

I think what you need to do is to run the ssh tunnel command after you start your container.

1. Remove sshpass command from docker file
2. Start your container with docker run (alternatively you can use docker-compose )
3. Run ssh tunnel command on running container with docker exec --detach YOUR_CONTAINER_NAME sshpass -p 'XXXXXXXXX' ssh -o StrictHostKeyChecking=no -L 3306:localhost:3306 username@mysite.com

Another solution is to wrap your commands in one bash script and put it in Dockerfile CMD ./my_wrapper_script.sh see the link .