mirror of
https://github.com/moby/moby.git
synced 2026-07-13 11:00:42 +00:00
0aba67203a
Same as "nat" mode, there's masquerading and port mapping from the host - but no port/protocol filtering for direct access to the container's address from remote hosts. This is the old default behaviour for IPv4 when the filter-FORWARD chain's default policy was "ACCEPT" (the daemon would only set it to "DROP" when it set sysctl "ip_forward" itself, but it didn't set up DROP rules for unpublished ports). Now, port filtering doesn't depend on the filter-FORWARD policy. So, this mode is added as a way to restore the old/surprising/insecure behaviour for anyone who's depending on it. Networks will need to be re-created with this new gateway mode. Signed-off-by: Rob Murray <rob.murray@docker.com>
libnetwork - networking for containers
Libnetwork provides a native Go implementation for connecting containers
The goal of libnetwork is to deliver a robust Container Network Model that provides a consistent programming interface and the required network abstractions for applications.
Design
Please refer to the design for more information.
Using libnetwork
There are many networking solutions available to suit a broad range of use-cases. libnetwork uses a driver / plugin model to support all of these solutions while abstracting the complexity of the driver implementations by exposing a simple and consistent Network Model to users.
Contributing
Want to hack on libnetwork? Docker's contributions guidelines apply.
Copyright and license
Code and documentation copyright 2015 Docker, inc. Code released under the Apache 2.0 license. Docs released under Creative commons.