Difuse/packages
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

docker-ce: Added blocked_interfaces config option

Browse source 
* blocked_interfaces blocks all packets to docker0 from the given
  interface. This is needed because all the iptables commands dockerd
  adds operate before any of the fw3 generated rules.

Signed-off-by: Gerard Ryan <G.M0N3Y.2503@gmail.com>
This commit is contained in:
Gerard Ryan 2020-10-29 18:49:55 +10:00
parent 93b13fafeb
commit 6be2d43e68
2 changed files with 29 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
utils/docker-ce/files/dockerd.init
View file

@ -125,6 +125,8 @@ process_config() {
config_load 'dockerd'
config_list_foreach firewall blocked_interfaces add_docker_firewall_rules
config_get alt_config_file globals alt_config_file
[ -n "${alt_config_file}" ] && [ -f "${alt_config_file}" ] && {
ln -s "${alt_config_file}" "${DOCKERD_CONF}"
@ -177,6 +179,18 @@ service_triggers() {
procd_add_reload_trigger 'dockerd'
}
add_docker_firewall_rules() {
. /lib/functions/network.sh
local device interface="${1}"
# Ignore errors as it might already be present
iptables --table filter --new DOCKER-USER 2>/dev/null
network_get_physdev device "${interface}"
if ! iptables --table filter --check DOCKER-USER --in-interface "${device}" --out-interface docker0 --jump DROP 2>/dev/null; then
iptables --table filter --insert DOCKER-USER --in-interface "${device}" --out-interface docker0 --jump DROP
fi
}
ip4tables_remove_nat() {
iptables --table nat --delete OUTPUT ! --destination 127.0.0.0/8 --match addrtype --dst-type LOCAL --jump DOCKER
iptables --table nat --delete PREROUTING --match addrtype --dst-type LOCAL --jump DOCKER
@ -186,25 +200,22 @@ ip4tables_remove_nat() {
}
ip4tables_remove_filter() {
# Chain DOCKER-USER is only present,
# if bip option is NOT set, so >/dev/null 2>&1
iptables --table filter --delete FORWARD --jump DOCKER-USER >/dev/null 2>&1
iptables --table filter --delete FORWARD --jump DOCKER-USER
iptables --table filter --delete FORWARD --jump DOCKER-ISOLATION-STAGE-1
iptables --table filter --delete FORWARD --out-interface docker0 --jump DOCKER
iptables --table filter --delete FORWARD --out-interface docker0 --match conntrack --ctstate RELATED,ESTABLISHED --jump ACCEPT
iptables --table filter --delete FORWARD --in-interface docker0 --out-interface docker0 --jump ACCEPT
iptables --table filter --delete FORWARD --in-interface docker0 ! --out-interface docker0 --jump ACCEPT
iptables --table filter --flush DOCKER
iptables --table filter --flush DOCKER-ISOLATION-STAGE-1
iptables --table filter --flush DOCKER-ISOLATION-STAGE-2
# Chain DOCKER-USER is only present,
# if bip option is NOT set, so >/dev/null 2>&1
iptables --table filter --flush DOCKER-USER >/dev/null 2>&1
iptables --table filter --flush DOCKER-USER
iptables --table filter --delete-chain DOCKER
iptables --table filter --delete-chain DOCKER-ISOLATION-STAGE-1
iptables --table filter --delete-chain DOCKER-ISOLATION-STAGE-2
# Chain DOCKER-USER is only present,
# if bip option is NOT set, so >/dev/null 2>&1
iptables --table filter --delete-chain DOCKER-USER >/dev/null 2>&1
iptables --table filter --delete-chain DOCKER-USER
}
ip4tables_remove() {

11
utils/docker-ce/files/etc/config/dockerd
View file

@ -1,11 +1,18 @@
# The following settings require a restart to take full effect, A reload will
# only have partial or no effect:
# option bip
# list blocked_interfaces
config globals 'globals'
# option alt_config_file "/etc/docker/daemon.json"
option data_root "/opt/docker/"
option log_level "warn"
list hosts "unix:///var/run/docker.sock"
# If the bip option is changed, dockerd must be restarted.
# A service reload is not enough.
option bip "172.18.0.1/24"
# list registry_mirrors "https://<my-docker-mirror-host>"
# list registry_mirrors "https://hub.docker.com"
# Docker ignores fw3 rules and by default all external source IPs are allowed
# to connect to the Docker host. See https://docs.docker.com/network/iptables/
config firewall 'firewall'
list blocked_interfaces 'wan'