Disabling Docker ICC still allows raw ethernet communication between containers

Re:Disabling Docker ICC still allows raw ethernet communicat... by bthornbury on Tuesday February 20, 2018 @06:18PM (#16425234)

Note that this repros on a default unprivileged container, with the default seccomp profile, and SELinux enabled.

Relevant filed issue: https://github.com/moby/moby/issues/36355

There are three immediate workarounds.

1. Dropping `CAP_SYS_RAW` in docker run will prevent the raw socket from being opened (and is always a good idea).

2. Placing each container on it's own bridge network blocks this communication but requires you to manually specify the subnets of those networks to work around dockers default limit of 31 networks.

3. Create ebtables rules, to filter below the ip layer (layer 2) see the repo for an example.

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by waittrtwut on Wednesday February 21, 2018 @01:52AM (#16427427)

For #2 did you mean CAP_NET_RAW or CAP_SYS_RAWIO?

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by bthornbury on Wednesday February 21, 2018 @02:18AM (#16427548)

CAP_SYS_RAWIO looks even more terrifying, but CAP_NET_RAW gates your ability to use raw sockets.

https://linux.die.net/man/7/capabilities

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by contingencies on Wednesday February 21, 2018 @04:06AM (#16428024)

I raised this stuff in 2014.

https://github.com/moby/moby/issues/5661

[ Parent | on HN ]