如果我需要提供额外的信息,请让我知道
解决方案一个选项是运行docker with - icc = false ,防止任何容器与主机或其他容器通信,然后可以通过将容器与 --link = container_name:别名。
您还可以使用iptables来执行以下规则:
iptables -A INPUT -i docker0 -d 192.168.0.0/16 -j DROP请记住,主机不会看到由icmp错误返回的丢包,所以在大多数情况下,REJECT可能更合适。
编辑:修改规则以阻止转发给其他主机:
iptables -I FORWARD -i docker0 -d 192.168.0.0/16 -j DROP
I am running Gentoo host with Ubuntu container in Docker. They communicate via bridge automatically created by Docker. I would like to drop all traffic for 192.168.0.0/16 that may come out of container.
$sudo iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT -A FORWARD -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 443 -j ACCEPT -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -A FORWARD -i docker0 ! -o docker0 -j ACCEPT -A FORWARD -i docker0 -o docker0 -j ACCEPT $sudo iptables -t nat -S -P PREROUTING ACCEPT -P INPUT ACCEPT -P OUTPUT ACCEPT -P POSTROUTING ACCEPT -N DOCKER -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A DOCKER ! -i docker0 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.17.0.2:443Please let me know if I need to provide extra information
解决方案One option would be to run docker with --icc=false, preventing any container to communicate with the host or with other containers, you could then let containers communicate with each other by linking them with --link=container_name:alias.
You could also operate with iptables with a rule like:
iptables -A INPUT -i docker0 -d 192.168.0.0/16 -j DROPkeep in mind that a host doesn't see dropped packet coming back by icmp error, so maybe REJECT is more appropriate in most cases.
edit: correcting the rule to block the forward to other hosts:
iptables -I FORWARD -i docker0 -d 192.168.0.0/16 -j DROP
更多推荐
禁止从docker容器访问LAN
发布评论