peter/infix
1
0
Fork 0
mirror of https://github.com/kernelkit/infix.git synced 2026-07-30 12:33:02 +02:00
Code Issues Packages Projects Releases Wiki Activity

doc: nftables container fixes

Browse Source 
- Must run in privileged mode
 - Fix copy-paste container name: system -> nftables
 - Point out the important settings

[skip ci]

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit is contained in:
Joachim Wiberg
2024-03-12 11:34:11 +01:00
parent 88ca959a61
commit 11c862bbd5
1 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
doc/container.md
+11 -7
View File
@@ -375,18 +375,22 @@ container ID (hash) is used, but this can be easily changed:
Infix currently does not have a native firewall configuration, and even
when it does it will never expose the full capabilities of `nftables`.
For really advanced setups, the following will be the only alternative:
For advanced setups, the following is an interesting alternative.
admin@example-c0-ff-ee:/> configure
admin@example-c0-ff-ee:/config> edit container nftables
admin@example-c0-ff-ee:/config/container/system/> set image ghcr.io/kernelkit/curios-nftables:edge
admin@example-c0-ff-ee:/config/container/system/> set network host
admin@example-c0-ff-ee:/config/container/system/> edit mount nftables.conf
admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> set target /etc/nftables.conf
admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> text-editor content
admin@example-c0-ff-ee:/config/container/nftables/> set image ghcr.io/kernelkit/curios-nftables:edge
admin@example-c0-ff-ee:/config/container/nftables/> set network host
admin@example-c0-ff-ee:/config/container/nftables/> set privileged true
admin@example-c0-ff-ee:/config/container/nftables/> edit mount nftables.conf
admin@example-c0-ff-ee:/config/container/nftables/mount/nftables.conf/> set target /etc/nftables.conf
admin@example-c0-ff-ee:/config/container/nftables/mount/nftables.conf/> text-editor content
... interactive editor starts up where you can paste your rules ...
admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> leave
admin@example-c0-ff-ee:/config/container/nftables/mount/nftables.conf/> leave
Notice how we `set network host`, so the container can see and act on
all the host's interfaces, and that we also have to run the container
in *privileged* mode.
### Application Container: ntpd