{"repo":"capnspacehook/whalewall","free":true,"listed":false,"github":"https://github.com/capnspacehook/whalewall","clone":"git clone https://github.com/capnspacehook/whalewall.git","description":"Automate management of firewall rules for Docker containers","language":"Go","stars":349,"topics":["docker","firewall","golang","security"],"license":"BSD-3-Clause","category":"deployment-docker-iac","readme_excerpt":"whalewall Automate management of firewall rules for Docker containers. Requirements Linux with a recent kernel, around 5.10 or newer. Purpose Docker by default creates iptables rules to handle container traffic that override almost all user-set rules. There are two main ways to get around this: 1. Prevent Docker from creating any iptables rules by setting \"iptables\": false in /etc/docker/daemon.json - This is the nuclear approach. It will break most networking for containers, and require that you manage iptables for containers manually, which can be a very involved process. 2. Add rules to the DOCKER-USER iptables chain - Docker ensures that rules in this chain are processed before any rules Docker creates. Adding rules to the DOCKER-USER chain is what whalewall does to avoid managing more firewall rules than it needs to. You may be wondering if whalewall is necessary, after all it is very easy to add firewall rules to the DOCKER-USER chain yourself. Well, Docker containers and networks are ephemeral, meaning every time a container or network is destroyed and recreated, the IP address and subnet respectively will be randomized. Whalewall takes care of creating or deleting rules when containers are created or killed, which would be very tedious and error-prone manually. Finally, as well as managing firewall rules to limit traffic to and from localhost and external interfaces, whalewall can also enforce container network isolation by limiting traffic between containers. Mechani","default_branch":null,"files":null,"tree":[],"storefront":"/r/capnspacehook","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/capnspacehook/whalewall/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}