Rob Murray 44a3453d73 Add daemon option --allow-direct-routing ...

Per-network option com.docker.network.bridge.trusted-host-interfaces
accepts a list of interfaces that are allowed to route
directly to a container's published ports in a bridge
network with nat enabled.

This daemon level option disables direct access filtering,
enabling direct access to published ports on container
addresses in all bridge networks, via all host interfaces.

It overlaps with short-term env-var workaround:
  DOCKER_INSECURE_NO_IPTABLES_RAW=1
- it does not allow packets sent from outside the host to reach
  ports published only to 127.0.0.1
- it will outlive iptables (the workaround was initially intended
  for hosts that do not have kernel support for the "raw" iptables
  table).

Signed-off-by: Rob Murray <rob.murray@docker.com>

2025-04-30 20:59:28 +01:00

..

docker-proxy

cmd/docker-proxy: do not eagerly GC one-sided UDP conns

2025-03-17 17:51:50 +01:00

dockerd

Add daemon option --allow-direct-routing

2025-04-30 20:59:28 +01:00