Does Docker's CAP_NET_ADMIN allow a container to affect the host network, or only it's own?connecting from docker container to docker hostHow should I configure SELinux when running nginx inside DockerTransparent proxying a single docker container to another docker containerIPTables port redirect with DockerIptables LOG rule inside a network namespaceHow does yum with Red Hat Network Subscription work inside the rhel Docker images?Configure iptables to secure a server running Docker containersSandbox docker containerTwo NICs docker host, fixed container source IP, no connection to second subnetSend received mirrored traffic using iptables to docker application?
Should I "tell" my exposition or give it through dialogue?
Will TSA allow me to carry a Continuous Positive Airway Pressure (CPAP)/sleep apnea device?
What's the correct term for a waitress in the Middle Ages?
How to make a setting relevant?
Payment instructions from HomeAway look fishy to me
How to make thick Asian sauces?
How can this map be coloured using four colours?
Etymology of 'calcit(r)are'?
Smooth switching between 12v batteries, with toggle switch
Implement Homestuck's Catenative Doomsday Dice Cascader
When writing an error prompt, should we end the sentence with a exclamation mark or a dot?
You've spoiled/damaged the card
What is the advantage of carrying a tripod and ND-filters when you could use image stacking instead?
Whats the next step after commercial fusion reactors?
My coworkers think I had a long honeymoon. Actually I was diagnosed with cancer. How do I talk about it?
Can you `= delete` a templated function on a second declaration?
Their answer is discrete, mine is continuous. They baited me into the wrong answer. I have a P Exam question
Through what methods and mechanisms can a multi-material FDM printer operate?
Incremental Ranges!
Why does the Schrödinger equation work so well for the Hydrogen atom despite the relativistic boundary at the nucleus?
Why did Hela need Heimdal's sword?
What happened to all the nuclear material being smuggled after the fall of the USSR?
Does an ice chest packed full of frozen food need ice? 18 day Grand Canyon trip
How would you say “AKA/as in”?
Does Docker's CAP_NET_ADMIN allow a container to affect the host network, or only it's own?
connecting from docker container to docker hostHow should I configure SELinux when running nginx inside DockerTransparent proxying a single docker container to another docker containerIPTables port redirect with DockerIptables LOG rule inside a network namespaceHow does yum with Red Hat Network Subscription work inside the rhel Docker images?Configure iptables to secure a server running Docker containersSandbox docker containerTwo NICs docker host, fixed container source IP, no connection to second subnetSend received mirrored traffic using iptables to docker application?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I have a docker container running a password authenticated SFTP server (client requirement - I've already lost that battle). In order to mitigate the risk of brute force attacks, I had thought to install iptables and fail2ban within the container. However, to get iptables working this requires that I allow the container NET_ADMIN rights.
I've not been able to find from the Docker documentation whether this allows the container simply to make changes to it's own network, or to amend the host network as well. All I have found is a summary, such as:
Capability Key | Capability Description
---------------|-----------------------
NET_ADMIN | Perform various network-related operations.
Reading the MAN pages linked from the Docker documentation provides a list of the capabilities that this imparts, but of course it's not written in the context of Docker ...
Perform various network-related operations:
- interface configuration;
- administration of IP firewall, masquerading, and accounting
- modify routing tables;
- bind to any address for transparent proxying;
- set type-of-service (TOS)
- clear driver statistics;
- set promiscuous mode;
- enabling multicasting;
... so I'm still unclear whether these abilities are granted at host level, or relates only to the container's network. An alternative strategy I'd come up with was to expose the container's auth.log using a shared volume and have fail2ban run on the host (I'd obviously have to set --iptables=false on the Docker engine), but I preferred the neatness of having no external host dependency and everything within a single container.
Can anyone allay my fears, or provide alternatives?
security permissions docker
asked Jun 1 '16 at 18:50
DanDan
1266
add a comment |
I have a docker container running a password authenticated SFTP server (client requirement - I've already lost that battle). In order to mitigate the risk of brute force attacks, I had thought to install iptables and fail2ban within the container. However, to get iptables working this requires that I allow the container NET_ADMIN rights.
I've not been able to find from the Docker documentation whether this allows the container simply to make changes to it's own network, or to amend the host network as well. All I have found is a summary, such as:
Capability Key | Capability Description
---------------|-----------------------
NET_ADMIN | Perform various network-related operations.
Reading the MAN pages linked from the Docker documentation provides a list of the capabilities that this imparts, but of course it's not written in the context of Docker ...
Perform various network-related operations:
- interface configuration;
- administration of IP firewall, masquerading, and accounting
- modify routing tables;
- bind to any address for transparent proxying;
- set type-of-service (TOS)
- clear driver statistics;
- set promiscuous mode;
- enabling multicasting;
... so I'm still unclear whether these abilities are granted at host level, or relates only to the container's network. An alternative strategy I'd come up with was to expose the container's auth.log using a shared volume and have fail2ban run on the host (I'd obviously have to set --iptables=false on the Docker engine), but I preferred the neatness of having no external host dependency and everything within a single container.
Can anyone allay my fears, or provide alternatives?
security permissions docker
asked Jun 1 '16 at 18:50
DanDan
1266
Have you ever figured this out?
– Keeper Hood
Apr 15 at 15:31
add a comment |
I have a docker container running a password authenticated SFTP server (client requirement - I've already lost that battle). In order to mitigate the risk of brute force attacks, I had thought to install iptables and fail2ban within the container. However, to get iptables working this requires that I allow the container NET_ADMIN rights.
I've not been able to find from the Docker documentation whether this allows the container simply to make changes to it's own network, or to amend the host network as well. All I have found is a summary, such as:
Capability Key | Capability Description
---------------|-----------------------
NET_ADMIN | Perform various network-related operations.
Reading the MAN pages linked from the Docker documentation provides a list of the capabilities that this imparts, but of course it's not written in the context of Docker ...
Perform various network-related operations:
- interface configuration;
- administration of IP firewall, masquerading, and accounting
- modify routing tables;
- bind to any address for transparent proxying;
- set type-of-service (TOS)
- clear driver statistics;
- set promiscuous mode;
- enabling multicasting;
... so I'm still unclear whether these abilities are granted at host level, or relates only to the container's network. An alternative strategy I'd come up with was to expose the container's auth.log using a shared volume and have fail2ban run on the host (I'd obviously have to set --iptables=false on the Docker engine), but I preferred the neatness of having no external host dependency and everything within a single container.
Can anyone allay my fears, or provide alternatives?
security permissions docker
asked Jun 1 '16 at 18:50
DanDan
1266
I have a docker container running a password authenticated SFTP server (client requirement - I've already lost that battle). In order to mitigate the risk of brute force attacks, I had thought to install iptables and fail2ban within the container. However, to get iptables working this requires that I allow the container NET_ADMIN rights.
I've not been able to find from the Docker documentation whether this allows the container simply to make changes to it's own network, or to amend the host network as well. All I have found is a summary, such as:
Capability Key | Capability Description
---------------|-----------------------
NET_ADMIN | Perform various network-related operations.
Reading the MAN pages linked from the Docker documentation provides a list of the capabilities that this imparts, but of course it's not written in the context of Docker ...
Perform various network-related operations:
- interface configuration;
- administration of IP firewall, masquerading, and accounting
- modify routing tables;
- bind to any address for transparent proxying;
- set type-of-service (TOS)
- clear driver statistics;
- set promiscuous mode;
- enabling multicasting;
... so I'm still unclear whether these abilities are granted at host level, or relates only to the container's network. An alternative strategy I'd come up with was to expose the container's auth.log using a shared volume and have fail2ban run on the host (I'd obviously have to set --iptables=false on the Docker engine), but I preferred the neatness of having no external host dependency and everything within a single container.
Can anyone allay my fears, or provide alternatives?
security permissions docker
security permissions docker
asked Jun 1 '16 at 18:50
DanDan
1266
asked Jun 1 '16 at 18:50
DanDan
1266
asked Jun 1 '16 at 18:50
DanDan
1266
asked Jun 1 '16 at 18:50
DanDan
1266
asked Jun 1 '16 at 18:50
DanDan
1266
1266
Have you ever figured this out?
– Keeper Hood
Apr 15 at 15:31
add a comment |
Have you ever figured this out?
– Keeper Hood
Apr 15 at 15:31
Have you ever figured this out?
– Keeper Hood
Apr 15 at 15:31
Have you ever figured this out?
– Keeper Hood
Apr 15 at 15:31
add a comment |
1 Answer
1
active
oldest
votes
That depends on whether you set --net=host or not:
Or as the man page puts it:
--net="bridge"
Set the Network mode for the container
'bridge': create a network stack on the default Docker bridge
'none': no networking
'container:': reuse another container's network stack
'host': use the Docker host network stack. Note: the host mode gives the container full access to
local system services such as D-bus and is therefore considered
insecure.
answered Mar 7 '17 at 20:15
DejDej
53
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f780370%2fdoes-dockers-cap-net-admin-allow-a-container-to-affect-the-host-network-or-onl%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
That depends on whether you set --net=host or not:
Or as the man page puts it:
--net="bridge"
Set the Network mode for the container
'bridge': create a network stack on the default Docker bridge
'none': no networking
'container:': reuse another container's network stack
'host': use the Docker host network stack. Note: the host mode gives the container full access to
local system services such as D-bus and is therefore considered
insecure.
answered Mar 7 '17 at 20:15
DejDej
53
add a comment |
That depends on whether you set --net=host or not:
Or as the man page puts it:
--net="bridge"
Set the Network mode for the container
'bridge': create a network stack on the default Docker bridge
'none': no networking
'container:': reuse another container's network stack
'host': use the Docker host network stack. Note: the host mode gives the container full access to
local system services such as D-bus and is therefore considered
insecure.
answered Mar 7 '17 at 20:15
DejDej
53
add a comment |
That depends on whether you set --net=host or not:
Or as the man page puts it:
--net="bridge"
Set the Network mode for the container
'bridge': create a network stack on the default Docker bridge
'none': no networking
'container:': reuse another container's network stack
'host': use the Docker host network stack. Note: the host mode gives the container full access to
local system services such as D-bus and is therefore considered
insecure.
answered Mar 7 '17 at 20:15
DejDej
53
That depends on whether you set --net=host or not:
Or as the man page puts it:
--net="bridge"
Set the Network mode for the container
'bridge': create a network stack on the default Docker bridge
'none': no networking
'container:': reuse another container's network stack
'host': use the Docker host network stack. Note: the host mode gives the container full access to
local system services such as D-bus and is therefore considered
insecure.
answered Mar 7 '17 at 20:15
DejDej
53
answered Mar 7 '17 at 20:15
DejDej
53
answered Mar 7 '17 at 20:15
DejDej
53
answered Mar 7 '17 at 20:15
DejDej
53
53
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f780370%2fdoes-dockers-cap-net-admin-allow-a-container-to-affect-the-host-network-or-onl%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Have you ever figured this out?
– Keeper Hood
Apr 15 at 15:31