kotovalexarian-likes-github
/
moby--moby
mirror of https://github.com/moby/moby.git
1
0
Fork 0
Code Releases Activity
moby--moby/libnetwork/firewall_others.go

7 lines
138 B
Go
Raw Normal View History

Add a filter chain to allow persistent rules Allow users to configure firewall policies in a way that persists docker operations/restarts. Docker will not delete or modify any pre-existing rules from the DOCKER-USER filter chain. This allows the user to create in advance any rules required to further restrict access from/to the containers. Fixes docker/docker#29184 Fixes docker/docker#23987 Related to docker/docker#24848 Signed-off-by: Jacob Wen <jian.w.wen@oracle.com>
2017-03-13 07:46:46 +00:00
// +build !linux
package libnetwork
DOCKER-USER chain not created when IPTableEnable=false. This fix addresses https://docker.atlassian.net/browse/ENGCORE-1115 Expected behaviors upon docker engine restarts: 1. IPTableEnable=true, DOCKER-USER chain present -- no change to DOCKER-USER chain 2. IPTableEnable=true, DOCKER-USER chain not present -- DOCKER-USER chain created and inserted top of FORWARD chain. 3. IPTableEnable=false, DOCKER-USER chain present -- no change to DOCKER-USER chain the rational is that DOCKER-USER is populated and may be used by end-user for purpose other than filtering docker container traffic. Thus even if IPTableEnable=false, docker engine does not touch pre-existing DOCKER-USER chain. 4. IPTableEnable=false, DOCKER-USER chain not present -- DOCKER-USER chain is not created. Signed-off-by: Su Wang <su.wang@docker.com>
2019-10-13 04:54:49 +00:00
func setupArrangeUserFilterRule(c *controller) {}
func arrangeUserFilterRule() {}