From a254e7d5af41b0ab7c2c37232b5ac2e8514aef48 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lucas=20Serv=C3=A9n=20Mar=C3=ADn?= Date: Thu, 21 Apr 2022 18:51:14 +0200 Subject: [PATCH] Dockerfile: support nftables MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Currently, Kilo _only_ supports adding firewall rules via the legacy iptables API. This means that on systems using nftables in the host network namespace, the namespace will be polluted and both firewall infrastructures will be used, causing unexpected and difficult to predict interactions. In other words, networking may not work as expected on nftables-based systems. This PR fixes this by using the iptables-wrappers project [0] to install run-time detection of the in-use iptables backend. [0] https://github.com/kubernetes-sigs/iptables-wrappers Signed-off-by: Lucas Servén Marín --- Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Dockerfile b/Dockerfile index dd3b7fe8..8edc3823 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,5 +13,7 @@ LABEL maintainer="squat " RUN echo -e "https://alpine.global.ssl.fastly.net/alpine/$ALPINE_VERSION/main\nhttps://alpine.global.ssl.fastly.net/alpine/$ALPINE_VERSION/community" > /etc/apk/repositories && \ apk add --no-cache ipset iptables ip6tables graphviz font-noto COPY --from=cni bridge host-local loopback portmap /opt/cni/bin/ +ADD https://raw.githubusercontent.com/kubernetes-sigs/iptables-wrappers/e139a115350974aac8a82ec4b815d2845f86997e/iptables-wrapper-installer.sh / +RUN chmod 700 /iptables-wrapper-installer.sh && /iptables-wrapper-installer.sh COPY bin/linux/$GOARCH/kg /opt/bin/ ENTRYPOINT ["/opt/bin/kg"]