Linux block outgoing traffic to a specific ip without iptables

Question

I basically need to run the following iptables -A OUTPUT -d 169.254.169.254 -j DROP except I cannot use iptables because the program is running in a docker container and I cannot use the --privileged argument (shared platform).

Is there an alternative to iptables that I could use to achieve the same result?

Answer 1

You might want to add a null route for that specific ip address. Although, this makes ALL communication to the address impossible, this accomplishes what you need.

You can find examples online of this. one of them. http://www.cyberciti.biz/tips/how-do-i-drop-or-block-attackers-ip-with-null-routes.html

Something like this

route add -host IP-ADDRESS reject

Answer 2

Docker, by the very definition of a container, is isolating you from the host environment. Anything that lets you do this from within the container without exposing the host via --privileged or some remote api interface should be a security exploit of the container.