News for hackers. Stuff that matters.

A comment on Disabling Docker ICC still allows raw ethernet communication between containers. Parent comment

Re:Disabling Docker ICC still allows raw ethernet communicat... by aidenn0 on Wednesday February 21, 2018 @02:05AM (#16427488)
Does disabling raw sockets still allow the various IPv6 ICMP messages that can be necessary for things like PMTU discovery to happen?
[ Parent | on HN ]
Re:Disabling Docker ICC still allows raw ethernet communicat... by toast0 on Thursday February 22, 2018 @11:40AM (#16438843)
It shouldn't -- the permission is for user mode programs to access raw sockets, and user mode programs aren't needed to generate and handle normal MTU ICMPs (on both IPv4 and IPv6).
[ Parent | on HN ]
Re:Disabling Docker ICC still allows raw ethernet communicat... by gtirloni on Wednesday February 21, 2018 @08:01AM (#16429092)
Supposedly, that happens a layer below the socket API so restricting the creation of raw sockets by userland shouldn't have an impact.
[ Parent | on HN ]