bundles/docker-engine: do not put containers on the host network

2025-02-15 10:32:56 +01:00 · 2025-02-15 10:32:56 +01:00 · 463443e1e3
commit 463443e1e3
parent aae1e8397e
2 changed files with 15 additions and 3 deletions
--- a/bundles/docker-engine/metadata.py
+++ b/bundles/docker-engine/metadata.py
@ -18,6 +18,19 @@ defaults = {
            '/var/opt/docker-engine',
        },
    },
+    'nftables': {
+        'forward': {
+            'docker-engine': [
+                'ct state { related, established } accept',
+                'iifname docker0 accept',
+            ],
+        },
+        'postrouting': {
+            'docker-engine': [
+                'iifname docker0 masquerade',
+            ],
+        },
+    },
    'hosts': {
        'entries': {
            '172.17.0.1': {