docker firewall "fails open" when DOCKER-USER chain already exists
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 2.2k
- Forks
- 875
- PR merge metrics
- No merged PRs in 30d
Description
when docker is launched, if the DOCKER-USER chain already exists, the jump DOCKER-USER rule is not inserted into the FORWARD chain, which results in the firewall "failing open".
this is potentially very hazardous from a security perspective. all that is required for this to happen is for a iptables/nftables "save" to contain the DOCKER-USER chain, and for the restore service to start before docker is started.
the culprit code is here:
one potential fix is to insert the jump even if the chain already exists, though in this case it may also be important to also always insert the return to the DOCKER-USER chain as well if it isn't already there.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in firewall_linux.go around line 33 and trace how the existing DOCKER-USER chain is handled during Docker startup. Reproduce the described saved iptables/nftables state, then verify that the FORWARD jump and the DOCKER-USER return behavior remain correct when the chain already exists.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100