<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Docker containers insert rules on start of the container and remove them on stop of the container to the base system’s iptables to allow for internal communications.
I’d be leery of interfering with that process. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Question that just occurred to me:
<br>
Would one classify the base OS (not the individual containers) as a hypervisor or is there a better term for it?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ale [mailto:ale-bounces@ale.org]
<b>On Behalf Of </b>James Sumners<br>
<b>Sent:</b> Tuesday, October 31, 2017 9:59 AM<br>
<b>To:</b> Atlanta Linux Enthusiasts - Yes! We run Linux!<br>
<b>Subject:</b> [ale] Speaking of containers: Docker and iptables<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">I need to update my internal Redis servers from RHEL6 to RHEL7. Since stupid
<a href="http://redis.io">redis.io</a> doesn't provide a yum repository, and the EPEL packages are "old stable," I am looking at deploying them with the `redis:4` image. While researching this plan, it has come to my attention that `dockerd` defaults to injecting
iptables rules automatically. This is not great; especially if you limit access to your Redis servers by firewall rules (i.e. only from certain clients).<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">So, let's say you use the packages from <a href="https://download.docker.com/linux/centos/7/x86_64/stable/">https://download.docker.com/linux/centos/7/x86_64/stable/</a> to run Docker. You will want to do the following to prevent this silliness:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">```<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">$ echo -e "[Service]\nExecStart=/usr/bin/dockerd --iptables=false" > /etc/systemd/system/docker.service<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">$ systemctl daemon-reload<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">$ systemctl restart docker.service<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">```<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal">James Sumners<br>
<a href="http://james.sumners.info/" target="_blank">http://james.sumners.info/</a> (technical profile)<br>
<a href="http://jrfom.com/" target="_blank">http://jrfom.com/</a> (personal site)<br>
<a href="http://haplo.bandcamp.com/" target="_blank">http://haplo.bandcamp.com/</a> (music)<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>