5

I basically need to run the following iptables -A OUTPUT -d 169.254.169.254 -j DROP except I cannot use iptables because the program is running in a docker container and I cannot use the --privileged argument (shared platform).

Is there an alternative to iptables that I could use to achieve the same result?

2 Answers 2

7

You might want to add a null route for that specific ip address. Although, this makes ALL communication to the address impossible, this accomplishes what you need.

You can find examples online of this. one of them. http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html

Something like this

route add -host IP-ADDRESS reject
2
  • Alternatively you can use the ip command to do the same thing, but check the man page for ip as you have a lot of options on how you want to block that address. Example where you want to silently discard the packets: ip route add blackhole 169.254.169.254 Commented Jun 22, 2016 at 19:11
  • Thanks, I'm getting similar errors using route and ip: "route: ioctl 0x890b failed: Operation not permitted" and "ip: RTNETLINK answers: Operation not permitted" which seems to have the same cause, stackoverflow.com/questions/27708376/…
    – WispyCloud
    Commented Jun 22, 2016 at 21:12
0

Docker, by the very definition of a container, is isolating you from the host environment. Anything that lets you do this from within the container without exposing the host via --privileged or some remote api interface should be a security exploit of the container.

1
  • Sure I know that, and I'm not trying to change anything on the host, I just want to block the traffic within the container so I am looking at a different way to achieve this result at a higher layer.
    – WispyCloud
    Commented Jun 22, 2016 at 21:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .