* Deploy specific iptables ruleset for each container... [not found] <1037489545.134365.1465266607461.JavaMail.yahoo.ref@mail.yahoo.com> @ 2016-06-07 2:30 ` Sebastián Maruca via Containers [not found] ` <1037489545.134365.1465266607461.JavaMail.yahoo-sAHhhX/85wgbqTNvkayDYw@public.gmane.org> 0 siblings, 1 reply; 2+ messages in thread From: Sebastián Maruca via Containers @ 2016-06-07 2:30 UTC (permalink / raw) To: containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org Hi to everyone! Is it possible to deploy a "central" iptables ruleset at a Host,and then, deploy several "isolated" iptables rulesets, one for each container? I'd like to have a this "central" iptables to chain basic rules,and each one of them have trivial rulesets, so as to speak of a"multi-tenant" IPTables. Best regards,Seba _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/containers ^ permalink raw reply [flat|nested] 2+ messages in thread
[parent not found: <1037489545.134365.1465266607461.JavaMail.yahoo-sAHhhX/85wgbqTNvkayDYw@public.gmane.org>]
* Re: Deploy specific iptables ruleset for each container... [not found] ` <1037489545.134365.1465266607461.JavaMail.yahoo-sAHhhX/85wgbqTNvkayDYw@public.gmane.org> @ 2016-06-07 15:30 ` James Bottomley 0 siblings, 0 replies; 2+ messages in thread From: James Bottomley @ 2016-06-07 15:30 UTC (permalink / raw) To: Sebastián Maruca, Sebastián Maruca, containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org On Tue, 2016-06-07 at 02:30 +0000, Sebastián Maruca via Containers wrote: > Hi to everyone! > Is it possible to deploy a "central" iptables ruleset at a Host,and > then, deploy several "isolated" iptables rulesets, one for each > container? > I'd like to have a this "central" iptables to chain basic rules,and > each one of them have trivial rulesets, so as to speak of a"multi > -tenant" IPTables. It depends what you mean by "deploy". Firewall rule sets are 1:1 with network namespaces, so it isn't possible to "inherit" rules from the parent netns. It is, however, perfectly possible to run a veth pair between two different netns and apply different firewall rules on each end with each rule set being in its own netns. It sounds like this could cover your use case. James _______________________________________________ Containers mailing list Containers@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/containers ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-06-07 15:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1037489545.134365.1465266607461.JavaMail.yahoo.ref@mail.yahoo.com>
2016-06-07 2:30 ` Deploy specific iptables ruleset for each container Sebastián Maruca via Containers
[not found] ` <1037489545.134365.1465266607461.JavaMail.yahoo-sAHhhX/85wgbqTNvkayDYw@public.gmane.org>
2016-06-07 15:30 ` James Bottomley
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox