Expose services on an instance

AMS allows an instance to expose a service to the outer network using instance services. You can do this by defining a port to expose on the instance endpoints.

Prerequisites

By default, external access to Anbox instances is restricted for security reasons. If you need to allow external access, you must enable access manually.

For charmed deployments, external access is blocked by the LXD charm. To allow access, expose this charm and configure the allowed port range:

juju expose lxd
juju config lxd exposed_instance_ports=10000-11000

For appliance deployments on public clouds, external access is controlled by the cloud platform. To enable access to Anbox instances, you must manually update the firewall or security group settings:

For AWS, configure the associated security group to allow inbound traffic on ports 10000-11000.

For Google Cloud, adjust the firewall rules to open the port range 10000-11000.

For Azure, perform the following action depending on whether you are doing this for a fresh deployment or an existing deployment:

  • If you are using the template for a fresh deployment, set exposeAnboxContainerServices to true.

  • For existing deployments, update the network security group to include 10000–11000 in the Destination port range.

Expose a service

The set of services to expose is defined when the instance is launched. For example, the following command exposes port 22 on the instance’s private endpoint:

amc launch -s tcp:22 bdp7kmahmss3p9i8huu0

Note

The specified port is exposed only on the IP address assigned to the instance. As the instance is normally not accessible from outside, the LXD node it is running on AMS sets up port forwarding rules on the node and maps the specified port to one in a higher port range (10000 - 110000).

The list of instances (amc ls) will now show the instance and the exposed port 22:

+----------------------+----------------+---------+---------+------+---------------+------------------------+
|          ID          |  APPLICATION   |  TYPE   | STATUS  | NODE |    ADDRESS    |       ENDPOINTS        |
+----------------------+----------------+---------+---------+------+---------------+------------------------+
| bdpaqaqhmss611ruq6kg |      candy     | regular | running | lxd0 | 192.168.100.2 | 192.168.100.2:22/tcp   |
|                      |                |         |         |      |               | 10.103.46.41:10000/tcp |
+----------------------+----------------+---------+---------+------+---------------+------------------------+

As described above, the port 22 is exposed only on the IP address assigned to the instance. In addition, it was mapped onto port 10000 on the address of the LXD node lxd0.

To help identifying services later on you can give them a name. For the example above we can simply name the service ssh:

amc launch -s ssh:tcp:22 bdp7kmahmss3p9i8huu0

This will help to identify which endpoint is used for which service:

+----------------------+----------------+---------+---------+------+---------------+----------------------------+
|          ID          |  APPLICATION   |  TYPE   | STATUS  | NODE |    ADDRESS    |       ENDPOINTS            |
+----------------------+----------------+---------+---------+------+---------------+----------------------------+
| bdpaqaqhmss611ruq6kg |      candy     | regular | running | lxd0 | 192.168.100.2 | ssh:192.168.100.2:22/tcp   |
|                      |                |         |         |      |               | ssh:10.103.46.41:10000/tcp |
+----------------------+----------------+---------+---------+------+---------------+----------------------------+

If we want to expose the service on the public endpoint of a LXD node, we must slightly change the service definition when the instance is launched:

amc launch -s +tcp:22 bdp7kmahmss3p9i8huu0

Notice the + in front of the port definition. This tells AMS to expose the service on the public endpoint of the LXD node on which the instance is scheduled. The instance list shows the public address of the node on which the instance is running, in the list of endpoints:

+----------------------+----------------+---------+---------+------+---------------+------------------------+
|          ID          |  APPLICATION   |  TYPE   | STATUS  | NODE |    ADDRESS    |       ENDPOINTS        |
+----------------------+----------------+---------+---------+------+---------------+------------------------+
| bdpaqaqhmss611ruq6kg |      candy     | regular | running | lxd0 | 192.168.100.2 | 192.168.100.2:22/tcp   |
|                      |                |         |         |      |               | 147.3.23.6:10000/tcp   |
+----------------------+----------------+---------+---------+------+---------------+------------------------+