Reputation
402
Top tag
Next privilege 500 Rep.
Access review queues
Badges
2 14
Newest
 Yearling
Impact
~7k people reached

  • 0 posts edited
  • 0 helpful flags
  • 33 votes cast
1d
awarded  Yearling
Jan
23
awarded  Popular Question
Jan
18
awarded  Self-Learner
Nov
30
answered Configure a Linux router for fair bandwidth allocation without unnecessary limiting it
Oct
23
accepted What is the point of the docker-proxy process? Why is a userspace tcp proxy needed?
Oct
23
answered What is the point of the docker-proxy process? Why is a userspace tcp proxy needed?
Oct
4
comment Restricting the network access of Docker container
1.) Docker sets up some rules on its own by default, and appending to them would do nothing as there is a catch-allish rule in place already, and prepending would break existing functionality (such as links) if one is not careful, so it's not that trivial. 2.) Does not answer the question. And OP already set it up like that. Also, my use case is different.
Oct
4
comment Restricting the network access of Docker container
Opened a question about the docker-proxy process: serverfault.com/questions/633604/…
Oct
4
asked What is the point of the docker-proxy process? Why is a userspace tcp proxy needed?
Oct
4
comment Restricting the network access of Docker container
Simply appending rules would do not nothing as docker already has catch-all rules in place. Simply prepending rules would override existing behaviours such as links. Btw I am confused about that userland proxy i talked about earlier, because is both userland proxies running (one for each published port), and then there is iptables rules in place related to that.
Oct
2
revised Is it realistic to host ESXi on a cloud VPS?
added 1 character in body
Oct
2
revised Is it realistic to host ESXi on a cloud VPS?
added 1 character in body
Oct
2
answered Is it realistic to host ESXi on a cloud VPS?
Oct
2
comment Restricting the network access of Docker container
Actually I am not even sure those rules are needed in any chain as by default Docker sets up masquerading for the containers, and as a result hides any port not explicitly published. If one uses the (questionable) default --icc=true setting, then communication is still allowed between containers, but lets assume --icc=false, so the only issue that remains is the still functioning Internet access inside the container. But if for some reason, one needs --icc=true, then yes, those rules need to be changed.
Oct
2
comment Restricting the network access of Docker container
Docker (assuming the default most supported configuration) publishes container ports on the host via its userspace tcp proxy, so I am not sure if the forwarding chain is even relevant for the rules concerning the sftp service.
Oct
2
comment Restricting the network access of Docker container
The docker container's upstream router (assuming the default most supported configuration) is the host on which it is running, and we are looking for a way disable a single container's Internet access on that host (not inside the container) while not breaking other docker functionality.
Sep
29
awarded  Critic
Sep
29
comment Mount Docker container contents in host file system
@dflemstr yes, there is, --volumes-from kinda does that, it appears to mount a union of the directory from the other container's base image and the volume, but this behaviour is not documented afaik
Sep
27
awarded  Investor
Sep
24
awarded  Autobiographer