opensafely-core / opensafely-core/backend-server
`jobrunner-db` docker network fails open
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 1
- Forks
- 5
- Avg merge
- 1h 36m
- Merged PRs (30d)
- 2
Description
The script which configures and creates this network is careful to set up all the relevant iptables rules before creating the network with the intention that there's never a point at which the network exists but is not correctly configured.
However, by default, the docker network is persistent across reboots and the iptables rules are not. This means that following a reboot there may be a period where the network exists but has no restrictions applied to it. If the iptables configuration fails for some reason then the network will be left open.
Slack discussion:
https://bennettoxford.slack.com/archives/C02GL3A9THD/p1731002551791659
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with services/jobrunner/sbin/jobrunner-network-config.sh and review how the Docker network and iptables rules are created across reboot and configuration failure scenarios. The change is complete when jobrunner-db cannot remain unrestricted after a reboot or an iptables setup failure, with the relevant failure paths verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, shell
- Domain
- infrastructure, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100