Disabling Docker ICC still allows raw ethernet communication between containers

Re:Disabling Docker ICC still allows raw ethernet communicat... by toast0 on Wednesday February 21, 2018 @12:01AM (#16426981)

Not by default. I've run two kinds of jails:

a) I didn't need much separation, I just wanted to run multiple environments on one box to save hardware; in this case, I enabled raw sockets, because it was convenient to ssh into the virtual environment and ping things.

b) things that I wanted really separate; for these environments, I left raw sockets disabled, the jail only contains the one executable (statically compiled); additionally, I also setup ipfw rules to prevent IP traffic from the jail from getting in or out, other than the specific things it was intended to do.

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by aidenn0 on Wednesday February 21, 2018 @02:05AM (#16427488)

Does disabling raw sockets still allow the various IPv6 ICMP messages that can be necessary for things like PMTU discovery to happen?

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by toast0 on Thursday February 22, 2018 @11:40AM (#16438843)

It shouldn't -- the permission is for user mode programs to access raw sockets, and user mode programs aren't needed to generate and handle normal MTU ICMPs (on both IPv4 and IPv6).

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by gtirloni on Wednesday February 21, 2018 @08:01AM (#16429092)

Supposedly, that happens a layer below the socket API so restricting the creation of raw sockets by userland shouldn't have an impact.

[ Parent | on HN ]