3 ms·

What is the status of TCP/IP networking in rootless runC? How can incoming and outgoing connections be restricted?

• cyphar 10y ago
  You can't both use iptables and have access to host network interfaces (as an unprivileged user), if that's what you mean. You can either create a network namespace and manage network interfaces (but not have a bridge to the host) or just deal with what access you're given. In the future my plan is to write a CNI plugin that implements pseudo-bridges in userspace so that you could get both (though I'm not sure if it'll work at the moment). But if you're an administrator you can restrict it like any other process.