Disabling Docker ICC still allows raw ethernet communication between containers

Re:Disabling Docker ICC still allows raw ethernet communicat... by paulfurtado on Wednesday February 21, 2018 @01:44AM (#16427402)

Re: bridge filtering

You can use the iptables physdev extension to match based on a bridge port rather than a mac address.

So to filter between containers, you can do:

  iptables -I FORWARD -m physdev --physdev-in vetha056126 -j DROP

where vetha056126 is the name of the container's veth adapter's peer interface on the host.

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by bthornbury on Wednesday February 21, 2018 @02:19AM (#16427551)

Perhaps I don't understand this rule properly, but isn't this dropping all traffic being forwarded from the interface?

[ Parent | on HN ]

Re:Disabling Docker ICC still allows raw ethernet communicat... by paulfurtado on Wednesday February 21, 2018 @02:47AM (#16427686)

When the sysctl net.bridge.bridge-nf-call-iptables=1 is set, bridged packets will traverse iptables rules. I believe this is the default on modern Linux kernels, but may not be set by default on RHEL/CentOS systems.

The iptables filter table has three chains: INPUT, OUTPUT, FORWARD. In a traditional non-bridge context:

- INPUT means packets entering the host

- OUTPUT means packets leaving the host

- FORWARD means packets being forwarded through the host which are not destined for the host itself.

In the context of a bridge, FORWARD means forwarding packets from one bridge port to another. You can test the simplest case of this with:

  iptables -I FORWARD -j DROP

by adding that rule, two containers on the same host cannot communicate with each other despite the fact that their communication did not require any traditional routing from the host. This is because the bridge traffic also traversed iptables rules.

[ Parent | on HN ]