Does Docker's CAP_NET_ADMIN allow a container to affect the host network, or only it's own?

Question

I have a docker container running a password authenticated SFTP server (client requirement - I've already lost that battle). In order to mitigate the risk of brute force attacks, I had thought to install iptables and fail2ban within the container. However, to get iptables working this requires that I allow the container NET_ADMIN rights.

I've not been able to find from the Docker documentation whether this allows the container simply to make changes to it's own network, or to amend the host network as well. All I have found is a summary, such as:

Capability Key | Capability Description
---------------|-----------------------
NET_ADMIN      | Perform various network-related operations.

Reading the MAN pages linked from the Docker documentation provides a list of the capabilities that this imparts, but of course it's not written in the context of Docker ...

Perform various network-related operations:
- interface configuration;
- administration of IP firewall, masquerading, and accounting
- modify routing tables;
- bind to any address for transparent proxying;
- set type-of-service (TOS)
- clear driver statistics;
- set promiscuous mode;
- enabling multicasting;

... so I'm still unclear whether these abilities are granted at host level, or relates only to the container's network. An alternative strategy I'd come up with was to expose the container's auth.log using a shared volume and have fail2ban run on the host (I'd obviously have to set --iptables=false on the Docker engine), but I preferred the neatness of having no external host dependency and everything within a single container.

Can anyone allay my fears, or provide alternatives?

Answer 1

That depends on whether you set --net=host or not:

Or as the man page puts it:

--net="bridge" Set the Network mode for the container 'bridge': create a network stack on the default Docker bridge 'none': no networking 'container:': reuse another container's network stack 'host': use the Docker host network stack. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.