bundles/docker-ce: add nftables rules

2022-12-24 18:22:29 +01:00 · 2022-12-24 18:22:29 +01:00 · 071250d798
commit 071250d798
parent efdff6ef28
2 changed files with 27 additions and 1 deletions
--- a/bundles/docker-ce/metadata.py
+++ b/bundles/docker-ce/metadata.py
@ -12,4 +12,30 @@ defaults = {
            'docker-ce-cli': {},
        },
    },
+    'nftables': {
+        'rules': {
+            '00-docker-ce': {
+                'inet filter forward ct state { related, established } accept',
+                'inet filter forward iifname docker0 accept',
+            },
+        },
+    },
 }
+
+
+@metadata_reactor.provides(
+    'nftables/rules/00-docker-ce',
+)
+def nftables_nat(metadata):
+    rules = set()
+
+    for iface in metadata.get('interfaces'):
+        rules.add(f'nat postrouting oifname {iface} masquerade')
+
+    return {
+        'nftables': {
+            'rules': {
+                '00-docker-ce': rules,
+            },
+        },
+    }