feat: migrate to nftables #63
Conversation
|
Warning Rate limit exceeded@qoomon has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 19 minutes and 16 seconds before requesting another review. How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. WalkthroughThe latest update transitions from using Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
qoomon
force-pushed
the
feature/migrate-to-nftables
branch
from
098ebef
to
8696127
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Inline review comments failed to post
Actionable comments posted: 2
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (2)
- Dockerfile (1 hunks)
- entrypoint.sh (2 hunks)
Files skipped from review due to trivial changes (1)
- Dockerfile
Additional context used
Shellcheck
entrypoint.sh
[warning] 74-74: This { is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 74-74: This } is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 75-75: This { is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 75-75: This } is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 77-77: In POSIX sh, string replacement is undefined.
(SC3060)
Additional comments not posted (3)
entrypoint.sh (3)
3-3: LGTM!Enabling strict error handling and debugging options is a good practice.
82-86: LGTM!The
nft add rule nat preroutingcommands correctly set up NAT rules for TCP and UDP protocols.
90-90: LGTM!The
nft add rule nat postrouting masqueradecommand correctly implements masquerading innftables.
Comments failed to post (2)
entrypoint.sh
77-77: Address Shellcheck warning for string replacement.
String replacement is undefined in POSIX sh. Consider using a compatible method.
- PORTS="$(echo ${PORTS//,/ })" + PORTS="$(echo "$PORTS" | tr ',' ' ')"Committable suggestion was skipped due to low confidence.
Tools
Shellcheck
[warning] 77-77: In POSIX sh, string replacement is undefined.
(SC3060)
72-76: Address Shellcheck warnings for nftables commands.
Shellcheck indicates potential issues with the
{and}characters. Ensure the commands are correctly formatted for POSIX sh.- nft add chain nat prerouting { type nat hook prerouting priority -100 \; } - nft add chain nat postrouting { type nat hook postrouting priority 100 \; } + nft add chain nat prerouting '{ type nat hook prerouting priority -100 ; }' + nft add chain nat postrouting '{ type nat hook postrouting priority 100 ; }'Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.# Create table and chains (do this only once) nft add table nat nft add chain nat prerouting '{ type nat hook prerouting priority -100 ; }' nft add chain nat postrouting '{ type nat hook postrouting priority 100 ; }'Tools
Shellcheck
[warning] 74-74: This { is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 74-74: This } is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 75-75: This { is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 75-75: This } is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
qoomon
force-pushed
the
feature/migrate-to-nftables
branch
from
8696127
to
f7abc86
Compare
There was a problem hiding this comment.
Caution
Inline review comments failed to post
Actionable comments posted: 1
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (3)
- Dockerfile (1 hunks)
- README.md (1 hunks)
- entrypoint.sh (1 hunks)
Files skipped from review due to trivial changes (1)
- README.md
Files skipped from review as they are similar to previous changes (1)
- Dockerfile
Additional context used
Shellcheck
entrypoint.sh
[warning] 74-74: This { is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 74-74: This } is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 75-75: This { is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 75-75: This } is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 77-77: In POSIX sh, string replacement is undefined.
(SC3060)
Additional comments not posted (2)
entrypoint.sh (2)
90-90: LGTM!The command for adding the masquerade rule using
nftablesis correct.
82-86: Fix Shellcheck warning for string replacement.String replacement
${PORTS//,/ }is undefined in POSIX sh. Use a compatible approach.- PORTS="$(echo ${PORTS//,/ })" + PORTS="$(echo "$PORTS" | tr ',' ' ')"Likely invalid or redundant comment.
Comments failed to post (1)
entrypoint.sh
72-76: Fix Shellcheck warnings for
nftablescommands.The
{and}characters need to be quoted to avoid Shellcheck warnings.- nft add chain nat prerouting { type nat hook prerouting priority -100 \; } - nft add chain nat postrouting { type nat hook postrouting priority 100 \; } + nft add chain nat prerouting '{ type nat hook prerouting priority -100 \; }' + nft add chain nat postrouting '{ type nat hook postrouting priority 100 \; }'Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.# Create table and chains (do this only once) nft add table nat nft add chain nat prerouting '{ type nat hook prerouting priority -100 \; }' nft add chain nat postrouting '{ type nat hook postrouting priority 100 \; }'Tools
Shellcheck
[warning] 74-74: This { is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 74-74: This } is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 75-75: This { is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
[warning] 75-75: This } is literal. Check expression (missing ;/\n?) or quote it.
(SC1083)
qoomon
force-pushed
the
feature/migrate-to-nftables
branch
from
f7abc86
to
6b09fa0
Compare
Summary by CodeRabbit
Chores
nftablesinstead ofiptablesfor improved network performance and security.Documentation
netcatserver setup commands, removing the-pflag for both TCP and UDP servers.Refactor
entrypoint.shto replaceiptablescommands withnftablescommands for setting up NAT rules, including TCP and UDP port forwarding and masquerading.