4 ms·
This is right, I remember now - docker does mangle your iptables chains. I remember fighting with this a while back. Terrible practice, in my opinion. Docker s
by junon 6y ago
This is right, I remember now - docker does mangle your iptables chains. I remember fighting with this a while back.
Terrible practice, in my opinion. Docker shouldn't be touching firewall stuff.
- krab 6y agoIptables magic is essential to how a lot of container networking stuff is implemented, though.
- peterwwillis 6y agoThis is (imho) a huge flaw in the concept of a "container". I don't think most people comprehend how much crap is going on in the background. For most container purposes, host networking and the default process namespace is absolutely fine, and reduces a lot of problems with interacting with containerized apps. 95% of the use case of containers is effectively just a chroot wrapper. If you need more features, this should be optional. This would also make rootless federated containerized apps just work. But nobody wants to go back to incremental features if Docker gives them everything at once.
- thr0w3345 6y agoIf you think that’s bad, wait til you see what the iptables-save output is like on an istio-proxy sidecar ;)
- junon 6y agoKubernetes as well. We ran into instances where iptables contention was so bad during outage recovery that things just stalled. iptables-save looked like a bomb went off.
- unilynx 6y agoI've resorted to adding my own firewall rules to the 'raw' table, which pretty much preempts all the rules Docker or the distribution inserts. It's not as powerful as the later tables in the chain (see https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilte... ) but a lot more robust.