1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Commit graph

4 commits

Author SHA1 Message Date
Sebastiaan van Stijn
686be57d0a
Update to Go 1.17.0, and gofmt with Go 1.17
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-24 23:33:27 +02:00
Su Wang
fcb70a0e86 DOCKER-USER chain not created when IPTableEnable=false.
This fix addresses https://docker.atlassian.net/browse/ENGCORE-1115
Expected behaviors upon docker engine restarts:
1. IPTableEnable=true, DOCKER-USER chain present
   -- no change to DOCKER-USER chain
2. IPTableEnable=true, DOCKER-USER chain not present
   -- DOCKER-USER chain created and inserted top of FORWARD
      chain.
3. IPTableEnable=false, DOCKER-USER chain present
   -- no change to DOCKER-USER chain
      the rational is that DOCKER-USER is populated
      and may be used by end-user for purpose other than
      filtering docker container traffic. Thus even if
      IPTableEnable=false, docker engine does not touch
      pre-existing DOCKER-USER chain.
4. IPTableEnable=false, DOCKER-USER chain not present
   -- DOCKER-USER chain is not created.

Signed-off-by: Su Wang <su.wang@docker.com>
2019-11-12 16:32:42 +00:00
Brian Goff
d5fef4ca1c Reload DOCKER-USER chain on frewalld reload.
Relates to moby/moby#35043

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2018-01-12 10:50:22 -05:00
Jacob Wen
c348cebe99 Add a filter chain to allow persistent rules
Allow users to configure firewall policies in a way that persists
docker operations/restarts. Docker will not delete or modify any
pre-existing rules from the DOCKER-USER filter chain. This allows
the user to create in advance any rules required to further
restrict access from/to the containers.

Fixes docker/docker#29184
Fixes docker/docker#23987
Related to docker/docker#24848

Signed-off-by: Jacob Wen <jian.w.wen@oracle.com>
2017-05-16 10:24:56 +08:00