Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bridge: Allow configuring port isolation #1009

Open
eirikrye opened this issue Jun 18, 2024 · 6 comments
Open

bridge: Allow configuring port isolation #1009

eirikrye opened this issue Jun 18, 2024 · 6 comments

Comments

@eirikrye
Copy link

eirikrye commented Jun 18, 2024

Hello,

podman version 5.0.3
alpine 3.20

I am trying to create podman networks where containers cannot:

  1. communicate with each other inside their own bridge (L2)
  2. communicate with containers on other bridges (L3)

Setting the bridge option isolate: true solves the second item (L3).

For the first item, I am able to disallow L2 communication by setting the isolated on (BR_ISOLATED flag) option on all the bridge ports manually, e.g.:

bridge link set dev veth0 isolated on
bridge link set dev veth1 isolated on

Is there a way to do this automatically, with netavark, as the bridge ports are created? Alternatively, if I am approaching this issue from the wrong end, is there a better way to achieve what I am looking for?

Also, the bridge driver source code references a possible strict value for the isolate option, however I am unable to find any documentation as to what this does, exactly. EDIT: It appears to also restrict access to bridges without any isolation set.

@Luap99
Copy link
Member

Luap99 commented Jun 18, 2024

I think docker calls this inter container connectivity (icc) so this is definitely something we want to support in order to allow better compatibility.

There isn't really anything pluggable which would allow you to set this automatically right now. So this would need to be implemented first. My thinking is to add a new icc option and the set the proper netlink attribute to block the connectivity between containers. PRs welcome.

cc @mheon

@eirikrye
Copy link
Author

eirikrye commented Jun 18, 2024

Thanks for the response!

Is there a way to hook into the network creation lifecycle with a shell script or something similar?

I quickly tried looking at the plugin API, and tried putting a tiny shell script in /usr/local/lib/netavark/test.sh that just dumps stdin to a file, but I'm not seeing this script being run after setting netavark_plugin_dirs = ["/usr/local/lib/netavark"] in /etc/containers/containers.conf.

@Luap99
Copy link
Member

Luap99 commented Jun 18, 2024

netavark plugin are specified in https://github.com/containers/netavark/blob/main/plugin-API.md but this isn't really what you want. You would need to completely reimplement the entire bridge code basically and then add your extra change.

There are oci hooks which would be more what you are looking for I think but there you have no relation between interface <-> container so you do not know which veth interface to pick.

That is why I said it is a new feature that has to be implemented first.

@mheon
Copy link
Member

mheon commented Jun 18, 2024

Concur with @Luap99 - seems like an eminently reasonable feature request, and not hard to implement, but will have to be in the existing bridge code.

@chetan-reddy
Copy link

chetan-reddy commented Oct 8, 2024

@eirikrye Were you able to get behavior equivalent to com.docker.network.bridge.enable_icc=false using either a netavark plugin or an OCI hook? If yes, could you please share your code?

@chetan-reddy
Copy link

Adding the following to my unit files does the job for me.

ExecStartPost=bash -c 'bridge link show master bridgename | cut -d: -f2 | cut -d@ -f1 | xargs -t -i bridge link set dev {} isolated on'

You can set the bridge name using the --interface-name option of podman network create

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

4 participants