moby--moby/libnetwork/firewall_others.go

// +build !linux

package libnetwork

func setupArrangeUserFilterRule(c *controller) {}
func arrangeUserFilterRule()                   {}
Add a filter chain to allow persistent rules Allow users to configure firewall policies in a way that persists docker operations/restarts. Docker will not delete or modify any pre-existing rules from the DOCKER-USER filter chain. This allows the user to create in advance any rules required to further restrict access from/to the containers. Fixes docker/docker#29184 Fixes docker/docker#23987 Related to docker/docker#24848 Signed-off-by: Jacob Wen <jian.w.wen@oracle.com> 2017-03-13 03:46:46 -04:00			`// +build !linux`

			`package libnetwork`

DOCKER-USER chain not created when IPTableEnable=false. This fix addresses https://docker.atlassian.net/browse/ENGCORE-1115 Expected behaviors upon docker engine restarts: 1. IPTableEnable=true, DOCKER-USER chain present -- no change to DOCKER-USER chain 2. IPTableEnable=true, DOCKER-USER chain not present -- DOCKER-USER chain created and inserted top of FORWARD chain. 3. IPTableEnable=false, DOCKER-USER chain present -- no change to DOCKER-USER chain the rational is that DOCKER-USER is populated and may be used by end-user for purpose other than filtering docker container traffic. Thus even if IPTableEnable=false, docker engine does not touch pre-existing DOCKER-USER chain. 4. IPTableEnable=false, DOCKER-USER chain not present -- DOCKER-USER chain is not created. Signed-off-by: Su Wang <su.wang@docker.com> 2019-10-13 00:54:49 -04:00			`func setupArrangeUserFilterRule(c *controller) {}`
			`func arrangeUserFilterRule() {}`