frodovdr/csf-post-docker
1
0
Fork 0
mirror of https://github.com/juliengk/csf-post-docker.git synced 2023-10-10 13:37:41 +02:00
Code Issues Releases Wiki Activity

Setup all networks, even those that don't have running containers.

Browse Source
This commit is contained in:
David Snopek 2016-11-09 09:25:03 -06:00
parent 1d69597f6b
commit 4b2bdc66f0
1 changed files with 12 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
docker.sh
View File

@ -23,6 +23,14 @@ add_to_forward() {
fi
}
add_to_nat() {
local docker_int=$1
local subnet=$2
iptables -t nat -A POSTROUTING -s ${subnet} ! -o ${docker_int} -j MASQUERADE
iptables -t nat -A DOCKER -i ${docker_int} -j RETURN
}
add_to_docker_isolation() {
local int_in=$1
local int_out=$2
@ -52,15 +60,15 @@ iptables -t nat -A POSTROUTING -s ${DOCKER_NETWORK} ! -o ${DOCKER_INT} -j MASQUE
bridges=`docker network ls -q --filter='Driver=bridge'`
for bridge in $bridges; do
DOCKER_NET_INT="br-$(echo $bridge | cut -c -12)"
DOCKER_NET_INT="br-$bridge"
subnet=`docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' $bridge`
iptables -t nat -A POSTROUTING -s ${subnet} ! -o ${DOCKER_NET_INT} -j MASQUERADE
iptables -t nat -A DOCKER -i ${DOCKER_NET_INT} -j RETURN
add_to_nat ${DOCKER_NET_INT} ${subnet}
add_to_forward ${DOCKER_NET_INT}
for other_bridge in $bridges; do
if [ $other_bridge != $bridge ]; then
add_to_docker_isolation br-$bridge br-$other_bridge
add_to_docker_isolation ${DOCKER_NET_INT} br-$other_bridge
fi
done
done
@ -77,16 +85,6 @@ if [ `echo ${containers} | wc -c` -gt "1" ]; then
else
DOCKER_NET_INT=br-$(docker inspect -f "{{.NetworkSettings.Networks.${netmode}.NetworkID}}" ${container} | cut -c -12)
ipaddr=`docker inspect -f "{{.NetworkSettings.Networks.${netmode}.IPAddress}}" ${container}`
add_to_docker_isolation ${DOCKER_NET_INT} ${DOCKER_INT}
add_to_docker_isolation ${DOCKER_INT} ${DOCKER_NET_INT}
add_to_forward ${DOCKER_NET_INT}
iptables -C -t nat -I DOCKER -i ${DOCKER_NET_INT} -j RETURN > /dev/null 2>&1
if [ $? -eq 0 ]; then
iptables -t nat -I DOCKER -i ${DOCKER_NET_INT} -j RETURN
fi
fi
rules=`docker port ${container} | sed 's/ //g'`