Bootstrap firewall features #2

papey · 2021-03-01T13:37:35Z

Linked to #1

For this setup :

go-iptables needs root access, see
SOCKET_UID to change ownership of the tap socket
DOCKER_BRIDGE_NAME identifies the bridge names inside docker daemon (ie: the name used in the docker network create command)

For now, go-iptables requires root access to iptable lock. In order to not run coredns as root, a dedicated user is used for socket ownership.

papey requested a review from athoune March 1, 2021 13:37

Wilfried OLLIVIER and others added 10 commits March 1, 2021 14:39

Add bridge interface env var

97f4218

Fix: with the name, it's better

f8fbab5

Fix: filter only on A for now

06be616

Bootstrap some go-iptables

e10b58c

More Darwin compability.

e401aca

Use a dedicated user id for socket path

0026e0f

For now, go-iptables requires root access to iptable lock. In order to not run coredns as root, a dedicated user is used for socket ownership.

Fix: the other way

b35f0d5

Add basic working approach for firewall

58dd0f7

Use from struct name

e4dbe04

Go mod tidy

5102d34

papey force-pushed the features/fw branch from 580175c to 5102d34 Compare March 1, 2021 13:44

athoune approved these changes Mar 1, 2021

View reviewed changes

athoune merged commit a581a01 into main Mar 1, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bootstrap firewall features #2

Bootstrap firewall features #2

papey commented Mar 1, 2021

Bootstrap firewall features #2

Bootstrap firewall features #2

Conversation

papey commented Mar 1, 2021