Repository navigation
libnetwork forces iptables on all bridges system-wide #47127
Description
libnetwork uses the br-netfilter module to allow filtering of packets passing through a bridge. To do so, it sets /proc/sys/net/bridge/bridge-nf-call-ip[6]tables to 1, forcing iptables for every bridge on the system, whether this is desired or not. This overrides anything set in /etc/sysctl.conf.
This is not Friendly Behaviour. iptables can be enabled per-bridge, by instead setting /sys/class/net/<bridge-name>/bridge/nf_call_ip[6]tables. Note that it cannot be disabled per-bridge when it is enabled system-wide, only enabled per-bridge when it is disabled system-wide. libnetwork should only enable iptables for the bridges it is managing.
See drivers/bridge/setup_bridgenetfiltering.go:71.
Activity
arkodg commentedon Jan 3, 2020
@tomkcook thanks for highlighting this issue, looks like this API can be extended to receive the bridge interface and only enable filtering per bridge - https://github.com/docker/libnetwork/blob/feeff4f0a3fd2a2bb19cf67c826082c66ffaaed9/drivers/bridge/setup_bridgenetfiltering.go#L111
tomkcook commentedon Jan 7, 2020
Note that, while IMO the change I have proposed is correct, it is not benign and still represents a significant change in behaviour. This is because, with the old behaviour, if any network configured by docker had
EnableICCset tofalse(anddocker_gwbridgeis configured in this way), then all bridges on the system would have netfilter/iptables enabled, whether they hadEnableICCset or not. Note that--iccon the dockerd commandline defaults to true and so by defaultdocker0hasEnableICCset totrue.This means that the default configuration will change from both
docker_gwbridgeanddocker0having iptables enabled todocker_gwbridgehaving iptables enabled anddocker0not having iptables enabled.arkodg commentedon Jan 7, 2020
good catch, I don't think this check is relevant anymore
https://github.com/docker/libnetwork/blob/feeff4f0a3fd2a2bb19cf67c826082c66ffaaed9/drivers/bridge/bridge.go#L727
and the dependency on
config.EnableICCshould be removed since we rely on iptables for so much more than just restricting inter container communication