Rob Murray 3cadadb4eb Add daemon option --ip-forward-no-drop ...

The daemon no longer depends on the iptables/ip6tables filter-FORWARD
chain's policy being DROP in order to implement its port filtering
rules.

However, if the daemon enables IP forwarding in the host's system
config, by default it will set the policy to DROP to avoid potential
security issues for other applications/networks.

If docker does need to enable IP forwarding, but other applications
on the host require filter-FORWARD's policies to be ACCEPT, this
option can be used to tell the daemon to leave the policy unchanged.
(Equivalent to enabling IP forwarding before starting the daemon,
but without needing to do that.)

Signed-off-by: Rob Murray <rob.murray@docker.com>

2024-11-11 12:12:57 +00:00

..

docker-proxy

cmd/docker-proxy: UDP: reply to clients with original daddr

2024-10-15 12:42:15 +02:00

dockerd

Add daemon option --ip-forward-no-drop

2024-11-11 12:12:57 +00:00