containers / containers/netavark
bridge: Allow configuring port isolation
- Dominant language
- Rust
- Stars
- 794
- Forks
- 161
- Avg merge
- 8d 17h
- Merged PRs (30d)
- 3
Description
Hello,
```
podman version 5.0.3
alpine 3.20
```
I am trying to create podman networks where containers cannot:
1. communicate with each other inside their own bridge (L2)
2. communicate with containers on other bridges (L3)
Setting the `bridge` option `isolate: true` solves the second item (L3).
For the first item, I am able to disallow L2 communication by setting the `isolated on` (`BR_ISOLATED` flag) option on all the bridge ports manually, e.g.:
```
bridge link set dev veth0 isolated on
bridge link set dev veth1 isolated on
```
Is there a way to do this automatically, with netavark, as the bridge ports are created? Alternatively, if I am approaching this issue from the wrong end, is there a better way to achieve what I am looking for?
Also, the bridge driver source code references a possible `strict` value for the `isolate` option, however I am unable to find any documentation as to what this does, exactly. **EDIT**: It appears to also restrict access to bridges without any isolation set.
Contributor guide
Assessment
This issue has not been assessed yet.