Support request for user defined iptables or iptables off/false, as in Docker Engine

[b1shan]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind feature

Description

Unlike Docker Engine, Podman does not provide support for turning iptables off or false, such as in dockerd cli or config. Moreover, Podman does not provide a user chain, such as DOCKER-USER, where users can put their own rules with the guarantee that they won't be oven run by Docker Engine.

Ref:
https://docs.docker.com/network/iptables/

[mheon]

This seems like it would need to be done inside of CNI.

[b1shan]

I think having either of the option would be a good start - option to turn iptables off or provide a predefined chain for users. The Podman security model is great, a strategic improvement over Docker Engine. This feature aligns with the security model Podman is pushing for IMO. Without this feature, several users are going to have trouble migrating over to Podman, especially the case of hybrid compute environments. The internet is full of usability issues with dockerd and iptables, before they provided an alternative.

[baude]

@b1shan willing to contribute?

[baude]

@b1shan also note, this would be for rootfull containers only?

[b1shan]

@baude yes, that is an option if this isn't a priority for anyone else at the moment. I am more from the user side, haven't seen the code much or the cni lib. If you all help with pointers where to do what, I can, why not.

[b1shan]

@baude not sure I understand what you mean by rootfull containers. This is for containers exposed on the network - on the host and from outside the host.

[baude]

the networking stack is setup differently when containers are run by root vs a regular user.

[rhatdan]

Right, rootless containers do not do anything with iptables.

[mheon]

We've had more requests for this before (specifically the USER chain)

[b1shan]

Spent a few mins looking at the CNI plugins repo and it seems setting iptables off should be rather straight forward, primarily in bridge and p2p plugins. Supporting USER chain, such as CNI-USER will be a bit of work though.

[b1shan]

A user chain is certainly a cleaner approach though, especially for dynamic workloads.

[github-actions]

This issue had no activity for 30 days. In the absence of activity or the "do-not-close" label, the issue will be automatically closed within 7 days.