containers / containers/netavark

bridge: Allow configuring port isolation

Open
#1,009 9 comments 0 reactions 0 assignees View on GitHub
kind/feature
Dominant language
Rust
Stars
794
Forks
161
Avg merge
8d 17h
Merged PRs (30d)
3

Description

Hello,

```
podman version 5.0.3
alpine 3.20
```

I am trying to create podman networks where containers cannot:

1. communicate with each other inside their own bridge (L2)
2. communicate with containers on other bridges (L3)

Setting the `bridge` option `isolate: true` solves the second item (L3).

For the first item, I am able to disallow L2 communication by setting the `isolated on` (`BR_ISOLATED` flag) option on all the bridge ports manually, e.g.:

```
bridge link set dev veth0 isolated on
bridge link set dev veth1 isolated on
```

Is there a way to do this automatically, with netavark, as the bridge ports are created? Alternatively, if I am approaching this issue from the wrong end, is there a better way to achieve what I am looking for?

Also, the bridge driver source code references a possible `strict` value for the `isolate` option, however I am unable to find any documentation as to what this does, exactly. **EDIT**: It appears to also restrict access to bridges without any isolation set.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.