Re:Disabling Docker ICC still allows raw ethernet communicat...
by toast0 on Wednesday February 21, 2018 @12:01AM
(#16426981)
Not by default. I've run two kinds of jails:
a) I didn't need much separation, I just wanted to run multiple environments on one box to save hardware; in this case, I enabled raw sockets, because it was convenient to ssh into the virtual environment and ping things.
b) things that I wanted really separate; for these environments, I left raw sockets disabled, the jail only contains the one executable (statically compiled); additionally, I also setup ipfw rules to prevent IP traffic from the jail from getting in or out, other than the specific things it was intended to do.
Re:Disabling Docker ICC still allows raw ethernet communicat...
by aidenn0 on Wednesday February 21, 2018 @02:05AM
(#16427488)
Does disabling raw sockets still allow the various IPv6 ICMP messages that can be necessary for things like PMTU discovery to happen?
Re:Disabling Docker ICC still allows raw ethernet communicat...
by toast0 on Thursday February 22, 2018 @11:40AM
(#16438843)
It shouldn't -- the permission is for user mode programs to access raw sockets, and user mode programs aren't needed to generate and handle normal MTU ICMPs (on both IPv4 and IPv6).
It sounds like the Docker folks aren't thrilled with enabling raw sockets by default, but enough people expect outbound ping to work.
(Linux's network stack does have an unprivileged ping, controlled by setting sysctl net.ipv4.ping_group_range appropriately; recent ping binaries support using it but I think most distros don't enable the sysctl. I'm guessing Docker could enable it within containers if they weren't worried about older distros that predate this support in ping.)