mirror of
https://github.com/moby/moby.git
synced 2026-01-11 18:51:37 +00:00
1ad9599da7
The Inter-Network Communication rules in the iptables chains
DOCKER-ISOLATION-STAGE-1 / DOCKER-ISOLATION-STAGE-2 (which are
called from filter-FORWARD) currently:
- Block access from containers in one bridge network, to ports
published to host addresses by containers in other bridge
networks, when the userland-proxy is disabled.
- But, that access is allowed when the proxy is enabled.
- Block access to all ports on container addresses in gateway
mode "nat-unprotected" networks.
- But, those ports can be accessed from anywhere else, including
other hosts. Just not other bridge networks.
- Allow access from containers in "nat" bridge networks to published
ports on container addresses in "routed" networks. But, to do that,
extra INC rules are added for the routed network.
The INC rules are no longer needed to block access from containers
in one network to unpublished ports on container addresses in
other networks. Direct routing to containers in NAT networks is
blocked by the "raw-PREROUTING" rules that block access from
untrusted interfaces (all interfaces apart from the network's
own bridge).
Drop these INC rules to resolve the inconsistencies listed above,
with this change:
- Published ports on host addresses can be accessed from containers
in other networks (even without the userland-proxy).
- The rules for direct routing between bridge networks are the same
as the rules for direct routing from outside the Docker host
(allowed for gw modes "routed" and "nat-unprotected", disallowed
for "nat").
Fewer rules, so it's simpler, and perhaps slightly faster.
Internal networks (with no access to networks outside the host)
are also implemented using rules in the DOCKER-ISOLATION chains.
This change moves those rules to a new chain, DOCKER-INTERNAL,
and drops the DOCKER-ISOLATION chains.
Signed-off-by: Rob Murray <rob.murray@docker.com>
1.6 KiB
1.6 KiB
Container on a user-defined network, with a published port, no userland proxy
Running the daemon with the userland proxy disabled then, as before, adding a network running a container with a mapped port, equivalent to:
dockerd --userland-proxy=false
docker network create \
-o com.docker.network.bridge.name=bridge1 \
--subnet 192.0.2.0/24 --gateway 192.0.2.1 bridge1
docker run --network bridge1 -p 8080:80 --name c1 busybox
The filter table is the same as with the userland proxy enabled.
Filter table
{{index . "LFilter4"}}
{{index . "SFilter4"}}
The nat table is:
{{index . "LNat4"}}
iptables commands
{{index . "SNat4"}}
Differences from running with the proxy are:
- The jump from the OUTPUT chain to DOCKER happens even for loopback addresses. ProgramChain.
- A MASQUERADE rule is added for packets sent from the container to one of its own published ports on the host.
- A MASQUERADE rule for packets from a LOCAL source address is included in POSTROUTING setupIPTablesInternal.
- In the DOCKER chain's DNAT rule, there's no destination bridge setPerPortNAT.