Cory Snider
a18fc28acb
Add coverage for the firewall rules which mark VXLAN datagrams for encryption. Each test joins a fresh network namespace and programs the rules into the kernel, so the rulesets are asserted as the kernel renders them rather than as the driver constructs them. The ordering is load-bearing for the correctness of the rules, and was not pinned by anything but a comment: - The rule which strips the encryption mark from socket-associated datagrams has to be evaluated after every rule which sets that mark, so that it neutralizes the unrestricted rules left behind by daemons predating the mark-spoofing fix. Reverting programMangleMarkSpoofProtection() to insert its rule at the head of the chain rather than appending it fails TestMangleMarkSpoofProtectionOrdering. The remaining cases cover replacing a legacy rule with the restricted one, the install and removal lifecycle for two VNIs, and the selection of ip6tables when the Swarm data plane is IPv6. Signed-off-by: Cory Snider <csnider@mirantis.com> Assisted-by: Claude Opus 5 (cherry picked from commit dcfd4926dde7ed878cfe6090a429c10d14ee0aeb) Signed-off-by: Cory Snider <csnider@mirantis.com>
libnetwork - networking for containers
Libnetwork provides a native Go implementation for connecting containers
The goal of libnetwork is to deliver a robust Container Network Model that provides a consistent programming interface and the required network abstractions for applications.
Design
Please refer to the design for more information.
Using libnetwork
There are many networking solutions available to suit a broad range of use-cases. libnetwork uses a driver / plugin model to support all of these solutions while abstracting the complexity of the driver implementations by exposing a simple and consistent Network Model to users.
Contributing
Want to hack on libnetwork? Docker's contributions guidelines apply.
Copyright and license
Code and documentation copyright 2015 Docker, inc. Code released under the Apache 2.0 license. Docs released under Creative commons.