Currently there are two iptables rules per port for each link: one to
allow the parent to connect to the child's port, and another one to
allow return traffic from the child back to the parent. The second rule
shouldn't be needed because the "ctstate RELATED,ESTABLISHED" rule can
already allow all established traffic.
So this patch does the following:
1. Move the RELATED,ESTABLISHED rule to be _before_ the potential
inter-container communication DROP rule so it will work for
inter-container traffic as well. Since we're inserting, everything
is reversed chronologically so it should be inserted _after_ we
insert the DROP. This also has a small performance benefit because
it will be processed earlier and it's generally one of the most
commonly used rules.
2. Get rid of the unnecessary return traffic rule per link.
3. Also move the other "Accept all non-intercontainer outgoing packets"
rule to earlier. This gives a small performance benefit since it's
also a commonly used rule, and it makes sense to logically group it
next to the ctstate rule.
Docker-DCO-1.1-Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> (github: jpoimboe)
Upstream-commit: 5c04f1bcc70e81fe3c93b1c246ce17a11304ad7f
Component: engine
Fix#3224 - Port already in use error when running a container
Signed-off-by: Tzu-Jung Lee <roylee17@gmail.com>
Upstream-commit: 7d2e851d8e921bf8f07f54c8afb8262580b36e8d
Component: engine
e.g.:
```
docker -d -bip "10.10.0.1/16"
```
If set and valid, use provided in place of trial and error from pre-defined array in network.go.
Mutually exclusive of -b option.
Upstream-commit: a68d7f3d70ab1638fd5b63a3026b211cb4e7a65e
Component: engine
On RHEL 6, creation of a bridge device with netlink fails. Use the more
backward-compatible ioctl instead. This fixes networking on RHEL 6.
Upstream-commit: 7a94cdf8edd917899a38a58917cd4439652047a1
Component: engine
Make sure the firewall rules are created even if the bridge interface is already created
Upstream-commit: 79031c4f8cd443a3d6fe26205b6d66830e306619
Component: engine
This commit improves upon the PortMapper and PortAllocator classes by changing
their internal data structures for port allocations to use a string rather than
a single integer. This string holds the network interface address as well as the
port number. This solves a previous problem where a port would be incorrectly
reported as being in use because it had been allocated for a different interface.
I've also added a basic test case for the PortMapper class, and extended the
existing test case for PortAllocator. In the case of PortMapper, this is done
by handing it a stub function for creating proxies rather than an actual
implementation.
Upstream-commit: 1cb1e08644b450d3371bfd7d6e305be454d19719
Component: engine
Explicitly enable container networking for Fedora and other distros that
have a REJECT all rule at the end of their FORWARD table.
Upstream-commit: ec4657b28a3e97447921357d454df974e0979ac6
Component: engine
Retrieve /etc/resolv.conf data (if available)
Add checkNameserverOverlaps and call it to
make sure there are no conflicts
Add utils.GetNameserversAsCIDR and tests
Read /etc/resolv.conf and pull out nameservers,
formatting them as a CIDR block ("1.2.3.4/32")
Upstream-commit: 3560c922b193e0f6b06c715a7b920f90a5990859
Component: engine
This allows the user to toggle enabling and
disabling intercontainer communication when
they run the daemon.
Upstream-commit: 94e5081baca9a3b3408d3a6ffa2926d1e262d6fe
Component: engine
We have our own netlink version of all the required calls now, so
we can just skip the /sbin/ip dependency.
Upstream-commit: 494cd07f722d6bf5f2e69a6d2d729848882e1971
Component: engine
Sometimes `ip route` will show mask-less IPs, so net.ParseCIDR will fail. If it does we check if we can net.ParseIP, and fail only if we can't.
Fixes#1214Fixes#362
Upstream-commit: 2e72882216ce13169a578614202830a5b084bfb4
Component: engine
