News for hackers. Stuff that matters.

A comment on Disabling Docker ICC still allows raw ethernet communication between containers. Parent comment

Re:Disabling Docker ICC still allows raw ethernet communicat... by waittrtwut on Wednesday February 21, 2018 @01:52AM (#16427427)
For #2 did you mean CAP_NET_RAW or CAP_SYS_RAWIO?
[ Parent | on HN ]
Re:Disabling Docker ICC still allows raw ethernet communicat... by bthornbury on Wednesday February 21, 2018 @02:18AM (#16427548)
CAP_SYS_RAWIO looks even more terrifying, but CAP_NET_RAW gates your ability to use raw sockets.

https://linux.die.net/man/7/capabilities

[ Parent | on HN ]
Re:Disabling Docker ICC still allows raw ethernet communicat... by contingencies on Wednesday February 21, 2018 @04:06AM (#16428024)
I raised this stuff in 2014.

https://github.com/moby/moby/issues/5661

[ Parent | on HN ]