network: fall back to blanket port block when cgroup isolation unavailable#66
Merged
navanchauhan merged 1 commit intomainfrom Mar 4, 2026
Merged
Conversation
…lable LinuxKit (Docker Desktop) and OrbStack kernels lack xt_cgroup / nft cgroupv2 socket matching, causing leash to FATAL on startup. When cgroup-scoped filtering fails, block ALL outbound connections to the control plane port instead. This still prevents the target container from reaching leashd while external access via Docker port publishing is unaffected. Also fix nftables ensure_rule comment quoting — nft requires literal quotes around comment values containing colons. Closes #60
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
xt_cgroup(iptables) ornft cgroupv2socket matching is unavailable, fall back to blocking ALL outbound connections to the control plane port instead of crashing with FATALensure_rulecomment quoting —nftrequires literal quotes around comment values containing colons (e.g."leash:block-control-plane-fallback")Why
Issue #60: LinuxKit kernels (Docker Desktop
6.12.68-linuxkit,6.12.72-linuxkit) and OrbStack (6.17.8-orbstack) do not shipxt_cgroupor supportnft socket cgroupv2matching. The cgroup-based iptables rule fails withRULE_APPEND failed (Invalid argument), causing leash to exit immediately.The fallback blanket port block (
-p tcp --dport $LEASH_PORT -j REJECT) still prevents the target container from reaching leashd since they share a network namespace. External access via Docker port publishing is unaffected (enters via INPUT, not OUTPUT).Validation
xt_cgroupunavailable on Docker Desktop LinuxKit6.12.72-linuxkitand OrbStack6.17.8-orbstackapply-iptables.sh,apply-ip6tables.sh,apply-nftables.sh) tested standalone on both runtimes — fallback rules applied successfullyleash -I sleep 60on OrbStack:tcp dpt:18080 reject-with tcp-resethttp://127.0.0.1:18080/(wget exit 4)Closes #60