Good morning at all. I am running Ubuntu 14.04 server and Docker 1.8.1 and UFW is my front-end to manage iptables.
I need to run an application into a container. I do need the following behavior:
- my app need to connect to another machine on port, to say, 8888/tcp.
- I do not want that docker manages my iptables, hence i have set
/etc/default/docker. That done, docker should now skip to set ANY iptables rule.
Then, i have done the following in UFW in order to get docker containers connect to the outside world:
I have also added the following lines to
/etc/ufw/before.rules to enable NAT functionalities:
# nat Table rules *nat :POSTROUTING ACCEPT [0:0] # Forward traffic from private network through eth0, the Internet iface on master. -A POSTROUTING -s 172.17.42.1/16 -o eth0 -j MASQUERADE # don't delete the 'COMMIT' line or these nat table rules won't be processed COMMIT
172.17.42.1/16 is the docker iface ip range.
After a reboot, i have ran
sudo iptables -t nat -L -n, which gives me:
[....] Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- 172.17.0.0/16 0.0.0.0/0
Then, since my
DEFAULT_OUTPUT_POLICY is set to
DROP, and i wanted to test whether the
iptables=false option actually works, i have ran:
docker run -it ubuntu:14.04 bash root@56997560933c:/# apt-get update
but..the container is able to download updates, even if the port 80/tcp and 53 are not open to the outside on the host machine..
I am know wondering...what i did wrong? what more i have to do in order to avoid that a docker container connects to the outside world using a port that i have not allowed in my iptables (using UFW) ?
Note for completeness:
There are no traces of DOCKER in any chain in my iptables. Also, when downloading updates, if i run
netstat , there are no ESTABLISHED connections outside ssh...this is even stranger...
reported from this question of another user, posted on stackoverflow. I think this is the right place.