libnetwork forces iptables on all bridges system-wide

[tomkcook]

libnetwork uses the br-netfilter module to allow filtering of packets passing through a bridge. To do so, it sets /proc/sys/net/bridge/bridge-nf-call-ip[6]tables to 1, forcing iptables for every bridge on the system, whether this is desired or not. This overrides anything set in /etc/sysctl.conf.

This is not Friendly Behaviour. iptables can be enabled per-bridge, by instead setting /sys/class/net/<bridge-name>/bridge/nf_call_ip[6]tables. Note that it cannot be disabled per-bridge when it is enabled system-wide, only enabled per-bridge when it is disabled system-wide. libnetwork should only enable iptables for the bridges it is managing.

See drivers/bridge/setup_bridgenetfiltering.go:71.

[arkodg]

@tomkcook thanks for highlighting this issue, looks like this API can be extended to receive the bridge interface and only enable filtering per bridge - https://github.com/docker/libnetwork/blob/feeff4f0a3fd2a2bb19cf67c826082c66ffaaed9/drivers/bridge/setup_bridgenetfiltering.go#L111

[tomkcook]

Note that, while IMO the change I have proposed is correct, it is not benign and still represents a significant change in behaviour. This is because, with the old behaviour, if any network configured by docker had EnableICC set to false (and docker_gwbridge is configured in this way), then all bridges on the system would have netfilter/iptables enabled, whether they had EnableICC set or not. Note that --icc on the dockerd commandline defaults to true and so by default docker0 has EnableICC set to true.

This means that the default configuration will change from both docker_gwbridge and docker0 having iptables enabled to docker_gwbridge having iptables enabled and docker0 not having iptables enabled.

[arkodg]

good catch, I don't think this check is relevant anymore
https://github.com/docker/libnetwork/blob/feeff4f0a3fd2a2bb19cf67c826082c66ffaaed9/drivers/bridge/bridge.go#L727
and the dependency on config.EnableICC should be removed since we rely on iptables for so much more than just restricting inter container communication