From 1d69597f6bf34a347201b0a46db0a0cdb1d952d5 Mon Sep 17 00:00:00 2001 From: David Snopek Date: Wed, 9 Nov 2016 08:46:49 -0600 Subject: [PATCH 1/3] Attempt to get rules matching what the docker daemon produces with regard to bridges --- docker.sh | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) diff --git a/docker.sh b/docker.sh index c0a5af9..2b418a8 100644 --- a/docker.sh +++ b/docker.sh @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash export PATH="$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" @@ -27,10 +27,7 @@ add_to_docker_isolation() { local int_in=$1 local int_out=$2 - iptables -C -A DOCKER-ISOLATION -i ${int_in} -o ${int_out} -j DROP > /dev/null 2>&1 - if [ $? -eq 0 ]; then - iptables -A DOCKER-ISOLATION -i ${int_in} -o ${int_out} -j DROP - fi + iptables -A DOCKER-ISOLATION -i ${int_in} -o ${int_out} -j DROP } DOCKER_INT="docker0" @@ -52,6 +49,22 @@ iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUERADE +bridges=`docker network ls -q --filter='Driver=bridge'` + +for bridge in $bridges; do + DOCKER_NET_INT="br-$(echo $bridge | cut -c -12)" + subnet=`docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' $bridge` + + iptables -t nat -A POSTROUTING -s ${subnet} ! -o ${DOCKER_NET_INT} -j MASQUERADE + iptables -t nat -A DOCKER -i ${DOCKER_NET_INT} -j RETURN + + for other_bridge in $bridges; do + if [ $other_bridge != $bridge ]; then + add_to_docker_isolation br-$bridge br-$other_bridge + fi + done +done + containers=`docker ps -q` if [ `echo ${containers} | wc -c` -gt "1" ]; then @@ -62,18 +75,12 @@ if [ `echo ${containers} | wc -c` -gt "1" ]; then DOCKER_NET_INT=${DOCKER_INT} ipaddr=`docker inspect -f "{{.NetworkSettings.IPAddress}}" ${container}` else - DOCKER_NET_INT="br-$(docker inspect -f \"{{.NetworkSettings.Networks.${netmode}.NetworkID}}\" ${container} | cut -c -12)" + DOCKER_NET_INT=br-$(docker inspect -f "{{.NetworkSettings.Networks.${netmode}.NetworkID}}" ${container} | cut -c -12) ipaddr=`docker inspect -f "{{.NetworkSettings.Networks.${netmode}.IPAddress}}" ${container}` add_to_docker_isolation ${DOCKER_NET_INT} ${DOCKER_INT} add_to_docker_isolation ${DOCKER_INT} ${DOCKER_NET_INT} - for net in `docker network ls | awk '{ print $2 }' | grep -Ev "bridge|host|null|ID|${netmode}"`; do - dint="br-$(docker network inspect -f '{{.Id}}' ${net} | cut -c -12)" - - add_to_docker_isolation ${DOCKER_NET_INT} ${dint} - done - add_to_forward ${DOCKER_NET_INT} iptables -C -t nat -I DOCKER -i ${DOCKER_NET_INT} -j RETURN > /dev/null 2>&1 From 4b2bdc66f06e84d1e3ca16a1c0cc2a855f243cdb Mon Sep 17 00:00:00 2001 From: David Snopek Date: Wed, 9 Nov 2016 09:25:03 -0600 Subject: [PATCH 2/3] Setup all networks, even those that don't have running containers. --- docker.sh | 26 ++++++++++++-------------- 1 file changed, 12 insertions(+), 14 deletions(-) diff --git a/docker.sh b/docker.sh index 2b418a8..0880ddf 100644 --- a/docker.sh +++ b/docker.sh @@ -23,6 +23,14 @@ add_to_forward() { fi } +add_to_nat() { + local docker_int=$1 + local subnet=$2 + + iptables -t nat -A POSTROUTING -s ${subnet} ! -o ${docker_int} -j MASQUERADE + iptables -t nat -A DOCKER -i ${docker_int} -j RETURN +} + add_to_docker_isolation() { local int_in=$1 local int_out=$2 @@ -52,15 +60,15 @@ iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUE bridges=`docker network ls -q --filter='Driver=bridge'` for bridge in $bridges; do - DOCKER_NET_INT="br-$(echo $bridge | cut -c -12)" + DOCKER_NET_INT="br-$bridge" subnet=`docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' $bridge` - iptables -t nat -A POSTROUTING -s ${subnet} ! -o ${DOCKER_NET_INT} -j MASQUERADE - iptables -t nat -A DOCKER -i ${DOCKER_NET_INT} -j RETURN + add_to_nat ${DOCKER_NET_INT} ${subnet} + add_to_forward ${DOCKER_NET_INT} for other_bridge in $bridges; do if [ $other_bridge != $bridge ]; then - add_to_docker_isolation br-$bridge br-$other_bridge + add_to_docker_isolation ${DOCKER_NET_INT} br-$other_bridge fi done done @@ -77,16 +85,6 @@ if [ `echo ${containers} | wc -c` -gt "1" ]; then else DOCKER_NET_INT=br-$(docker inspect -f "{{.NetworkSettings.Networks.${netmode}.NetworkID}}" ${container} | cut -c -12) ipaddr=`docker inspect -f "{{.NetworkSettings.Networks.${netmode}.IPAddress}}" ${container}` - - add_to_docker_isolation ${DOCKER_NET_INT} ${DOCKER_INT} - add_to_docker_isolation ${DOCKER_INT} ${DOCKER_NET_INT} - - add_to_forward ${DOCKER_NET_INT} - - iptables -C -t nat -I DOCKER -i ${DOCKER_NET_INT} -j RETURN > /dev/null 2>&1 - if [ $? -eq 0 ]; then - iptables -t nat -I DOCKER -i ${DOCKER_NET_INT} -j RETURN - fi fi rules=`docker port ${container} | sed 's/ //g'` From 070d8ddca05785be7b49f3576e120b58f7ee4892 Mon Sep 17 00:00:00 2001 From: David Snopek Date: Wed, 9 Nov 2016 13:33:17 -0600 Subject: [PATCH 3/3] Return the shebang to /bin/sh --- docker.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker.sh b/docker.sh index 0880ddf..ac88dd5 100644 --- a/docker.sh +++ b/docker.sh @@ -1,4 +1,4 @@ -#!/bin/bash +#!/bin/sh export PATH="$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"