<div dir="ltr">This has nothing to do with the internal communications between running containers. Those have their own network. This is about Docker exposing ports specified with `EXPOSE 12345` lines in Dockerfiles to the outside world. From my Harbor server (VMware's "hub" product):<div><br></div><div>```</div><div><div>Chain DOCKER (2 references)</div><div>target prot opt source destination</div><div>ACCEPT tcp -- <a href="http://0.0.0.0/0">0.0.0.0/0</a> 172.18.0.2 tcp dpt:514</div><div>ACCEPT tcp -- <a href="http://0.0.0.0/0">0.0.0.0/0</a> 172.18.0.7 tcp dpt:4443</div><div>ACCEPT tcp -- <a href="http://0.0.0.0/0">0.0.0.0/0</a> 172.18.0.7 tcp dpt:443</div><div>ACCEPT tcp -- <a href="http://0.0.0.0/0">0.0.0.0/0</a> 172.18.0.7 tcp dpt:80</div></div><div>```</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 31, 2017 at 10:21 AM, Lightner, Jeffrey <span dir="ltr"><<a href="mailto:JLightner@dsservices.com" target="_blank">JLightner@dsservices.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_-4216455774441893518WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Docker containers insert rules on start of the container and remove them on stop of the container to the base system’s iptables to allow for internal communications.
I’d be leery of interfering with that process. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Question that just occurred to me:
<br>
Would one classify the base OS (not the individual containers) as a hypervisor or is there a better term for it?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ale [mailto:<a href="mailto:ale-bounces@ale.org" target="_blank">ale-bounces@ale.org</a>]
<b>On Behalf Of </b>James Sumners<br>
<b>Sent:</b> Tuesday, October 31, 2017 9:59 AM<br>
<b>To:</b> Atlanta Linux Enthusiasts - Yes! We run Linux!<br>
<b>Subject:</b> [ale] Speaking of containers: Docker and iptables<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">I need to update my internal Redis servers from RHEL6 to RHEL7. Since stupid
<a href="http://redis.io" target="_blank">redis.io</a> doesn't provide a yum repository, and the EPEL packages are "old stable," I am looking at deploying them with the `redis:4` image. While researching this plan, it has come to my attention that `dockerd` defaults to injecting
iptables rules automatically. This is not great; especially if you limit access to your Redis servers by firewall rules (i.e. only from certain clients).<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">So, let's say you use the packages from <a href="https://download.docker.com/linux/centos/7/x86_64/stable/" target="_blank">https://download.docker.<wbr>com/linux/centos/7/x86_64/<wbr>stable/</a> to run Docker. You will want to do the following to prevent this silliness:<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">```<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">$ echo -e "[Service]\nExecStart=/usr/<wbr>bin/dockerd --iptables=false" > /etc/systemd/system/docker.<wbr>service<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">$ systemctl daemon-reload<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">$ systemctl restart docker.service<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">```<br clear="all">
<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<p class="MsoNormal">-- <u></u><u></u></p>
<div>
<p class="MsoNormal">James Sumners<br>
<a href="http://james.sumners.info/" target="_blank">http://james.sumners.info/</a> (technical profile)<br>
<a href="http://jrfom.com/" target="_blank">http://jrfom.com/</a> (personal site)<br>
<a href="http://haplo.bandcamp.com/" target="_blank">http://haplo.bandcamp.com/</a> (music)<u></u><u></u></p>
</div>
</div>
</div>
</div></div></div>
</div>
<br>______________________________<wbr>_________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/<wbr>listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/<wbr>listinfo</a><br>
<br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature">James Sumners<br><a href="http://james.sumners.info/" target="_blank">http://james.sumners.info/</a> (technical profile)<br><a href="http://jrfom.com/" target="_blank">http://jrfom.com/</a> (personal site)<br><a href="http://haplo.bandcamp.com/" target="_blank">http://haplo.bandcamp.com/</a> (music)</div>
</div>