sbwml
+5
-50
@@ -153,7 +153,7 @@ ucidel() {
|
||||
}
|
||||
|
||||
process_config() {
|
||||
local alt_config_file data_root log_level iptables ip6tables bip
|
||||
local alt_config_file data_root log_level nftables bip
|
||||
|
||||
[ -f /etc/config/dockerd ] || {
|
||||
# Use the daemon default configuration
|
||||
@@ -174,8 +174,7 @@ process_config() {
|
||||
|
||||
config_get data_root globals data_root "/opt/docker/"
|
||||
config_get log_level globals log_level "warn"
|
||||
config_get_bool iptables globals iptables "1"
|
||||
config_get_bool ip6tables globals ip6tables "0"
|
||||
config_get_bool nftables globals nftables "1"
|
||||
|
||||
# Don't add these options by default
|
||||
# omission == docker defaults
|
||||
@@ -200,8 +199,9 @@ process_config() {
|
||||
json_init
|
||||
json_add_string "data-root" "${data_root}"
|
||||
json_add_string "log-level" "${log_level}"
|
||||
json_add_boolean "iptables" "${iptables}"
|
||||
json_add_boolean "ip6tables" "${ip6tables}"
|
||||
[ "${nftables}" = "1" ] && {
|
||||
json_add_string "firewall-backend" "nftables"
|
||||
}
|
||||
[ "${buildkit}" = "1" ] && {
|
||||
json_add_object 'features'
|
||||
json_add_boolean "buildkit" "${buildkit}"
|
||||
@@ -232,8 +232,6 @@ process_config() {
|
||||
fi
|
||||
[ -z "${storage_driver}" ] || json_add_string "storage-driver" "${storage_driver}"
|
||||
json_dump > "${DOCKERD_CONF}"
|
||||
|
||||
[ "${iptables}" -eq "1" ] && config_foreach iptables_add_blocking_rule firewall
|
||||
}
|
||||
|
||||
start_service() {
|
||||
@@ -261,49 +259,6 @@ service_triggers() {
|
||||
procd_add_reload_trigger 'dockerd'
|
||||
}
|
||||
|
||||
iptables_add_blocking_rule() {
|
||||
local cfg="${1}"
|
||||
|
||||
local device=""
|
||||
local extra_iptables_args=""
|
||||
|
||||
handle_iptables_rule() {
|
||||
local interface="${1}"
|
||||
local outbound="${2}"
|
||||
local extra_iptables_args="${3}"
|
||||
|
||||
local inbound=""
|
||||
|
||||
. /lib/functions/network.sh
|
||||
network_get_physdev inbound "${interface}"
|
||||
|
||||
[ -z "${inbound}" ] && {
|
||||
logger -t "dockerd-init" -p notice "Unable to get physical device for interface ${interface}"
|
||||
return
|
||||
}
|
||||
|
||||
# Wait for a maximum of 10 second per command, retrying every millisecond
|
||||
local iptables_wait_args="--wait 10 --wait-interval 1000"
|
||||
|
||||
# Ignore errors as it might already be present
|
||||
iptables ${iptables_wait_args} --table filter --new DOCKER-USER 2>/dev/null
|
||||
if ! iptables ${iptables_wait_args} --table filter --check DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT 2>/dev/null; then
|
||||
logger -t "dockerd-init" -p notice "Drop traffic from ${inbound} to ${outbound}"
|
||||
iptables ${iptables_wait_args} --table filter --insert DOCKER-USER --in-interface "${inbound}" --out-interface "${outbound}" ${extra_iptables_args} --jump REJECT
|
||||
fi
|
||||
}
|
||||
|
||||
config_get device "${cfg}" device
|
||||
|
||||
[ -z "${device}" ] && {
|
||||
logger -t "dockerd-init" -p notice "No device configured for ${cfg}"
|
||||
return
|
||||
}
|
||||
|
||||
config_get extra_iptables_args "${cfg}" extra_iptables_args
|
||||
config_list_foreach "${cfg}" blocked_interfaces handle_iptables_rule "${device}" "${extra_iptables_args}"
|
||||
}
|
||||
|
||||
stop_service() {
|
||||
if /etc/init.d/dockerd running; then
|
||||
service_stop "/usr/bin/dockerd"
|
||||
|
||||
@@ -10,7 +10,7 @@ config globals 'globals'
|
||||
option data_root '/opt/docker/'
|
||||
# option log_driver 'local'
|
||||
option log_level 'warn'
|
||||
option iptables '1'
|
||||
option nftables '1'
|
||||
# list hosts 'unix:///var/run/docker.sock'
|
||||
# option bip '172.18.0.1/24'
|
||||
# option fixed_cidr '172.17.0.0/16'
|
||||
@@ -30,18 +30,8 @@ config proxies 'proxies'
|
||||
# option https_proxy 'https://proxy.example.com:3129'
|
||||
# option no_proxy '*.test.example.com,.example.org,127.0.0.0/8'
|
||||
|
||||
# Docker doesn't work well out of the box with fw4. This is because Docker relies on a compatibility layer that
|
||||
# naively translates iptables rules. For the best compatibility replace the following dependencies:
|
||||
# `firewall4` -> `firewall`
|
||||
# `iptables-nft` -> `iptables-legacy`
|
||||
# `ip6tables-nft` -> `ip6tables-legacy`
|
||||
|
||||
# Docker undermines the fw3 rules. By default all external source IPs are allowed to connect to the Docker host.
|
||||
# See https://docs.docker.com/network/iptables/ for more details.
|
||||
|
||||
# firewall config changes are only additive i.e firewall will need to be restarted first to clear old changes,
|
||||
# then docker restarted to load in new changes.
|
||||
config firewall 'firewall'
|
||||
option device 'docker0'
|
||||
# list blocked_interfaces 'wan'
|
||||
# option extra_iptables_args '--match conntrack ! --ctstate RELATED,ESTABLISHED' # allow outbound connections
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
# Do not edit, changes to this file will be lost on upgrades
|
||||
# /etc/sysctl.conf can be used to customize sysctl settings
|
||||
|
||||
# enable bridge firewalling for docker
|
||||
#net.bridge.bridge-nf-call-ip6tables=1
|
||||
#net.bridge.bridge-nf-call-iptables=1
|
||||
|
||||
Reference in New Issue
Block a user