From d04da92a234a36760556e1c0a7a8ffaa4c1db686 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lucas=20Serv=C3=A9n=20Mar=C3=ADn?= Date: Thu, 21 Apr 2022 18:51:14 +0200 Subject: [PATCH] Dockerfile: support nftables MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently, Kilo _only_ supports adding firewall rules via the legacy iptables API. This means that on systems using nftables in the host network namespace, the namespace will be polluted and both firewall infrastructures will be used, causing unexpected and difficult to predict interactions. In other words, networking may not work as expected on nftables-based systems. This PR fixes this by using the iptables-wrappers project [0] to install run-time detection of the in-use iptables backend. [0] https://github.com/kubernetes-sigs/iptables-wrappers Signed-off-by: Lucas Servén Marín --- Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Dockerfile b/Dockerfile index dd3b7fe..b0e5a8b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,5 +13,7 @@ LABEL maintainer="squat " RUN echo -e "https://alpine.global.ssl.fastly.net/alpine/$ALPINE_VERSION/main\nhttps://alpine.global.ssl.fastly.net/alpine/$ALPINE_VERSION/community" > /etc/apk/repositories && \ apk add --no-cache ipset iptables ip6tables graphviz font-noto COPY --from=cni bridge host-local loopback portmap /opt/cni/bin/ +ADD https://raw.githubusercontent.com/kubernetes-sigs/iptables-wrappers/e139a115350974aac8a82ec4b815d2845f86997e/iptables-wrapper-installer.sh / +RUN chmod 700 /iptables-wrapper-installer.sh && /iptables-wrapper-installer.sh --no-sanity-check COPY bin/linux/$GOARCH/kg /opt/bin/ ENTRYPOINT ["/opt/bin/kg"]