Compare commits
24 commits
Author | SHA1 | Date | |
---|---|---|---|
7e7dd05276 | |||
3201ac7be6 | |||
c7578c1fc8 | |||
aa12d23858 | |||
ac5e859977 | |||
0a7a3f70eb | |||
063ea9b64b | |||
409ad256f0 | |||
2ad4a88382 | |||
dd5ee5c832 | |||
a5db9d457d | |||
b7aaf2253b | |||
d55391bf15 | |||
5524987beb | |||
bf1e27cad3 | |||
f1a0ef62d2 | |||
bcb21618a2 | |||
0951031c35 | |||
4d52e80b0f | |||
d95c49a1c4 | |||
25af0cff8b | |||
d6890b19e3 | |||
d72596fe04 | |||
7c218fc664 |
1 changed files with 6 additions and 9 deletions
15
README.md
15
README.md
|
@ -20,19 +20,14 @@ You can define rules per container using specific Docker labels:
|
||||||
| **Label Key** | **Description** | **Default** |
|
| **Label Key** | **Description** | **Default** |
|
||||||
|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-------------|
|
|----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-------------|
|
||||||
| `magicfw.firewall.allow_icc` | Enables communication between the container and other containers on different Docker networks (not normally possible in Docker environments). | `false` |
|
| `magicfw.firewall.allow_icc` | Enables communication between the container and other containers on different Docker networks (not normally possible in Docker environments). | `false` |
|
||||||
| `magicfw.firewall.allow_external` | Enables access from external networks (e.g., the internet) for the container. | `false` |
|
| `magicfw.firewall.allow_external` | Enables access to external networks (e.g., the internet) for the container. | `false` |
|
||||||
|
|
||||||
### Behavior and Functionalities
|
### Behavior and Functionalities
|
||||||
- **Allow ICC (Inter-Container Communication):** When `magicfw.firewall.allow_icc` is `true`, the container can communicate with other containers across **different Docker networks** (useful for applications like reverse proxies such as Traefik). If `false`, the container is isolated from other Docker networks (default Docker behavior).
|
- **Allow ICC (Inter-Container Communication):** When `magicfw.firewall.allow_icc` is `true`, the container can communicate with other containers across **different Docker networks** (useful for applications like reverse proxies such as Traefik). If `false`, the container is isolated from other Docker networks (default Docker behavior).
|
||||||
- **External Traffic:** When `magicfw.firewall.allow_external` is `true`, the container's network rules allow communication from external networks (useful when NAT is disabled).
|
- **External Traffic:** When `magicfw.firewall.allow_external` is `true`, the container's network rules allow communication with external IPs.
|
||||||
- **Automatic Rule Cleanup:** When a container is restarted, stopped, or removed, the corresponding firewall rules are automatically cleaned.
|
- **Automatic Rule Cleanup:** When a container is restarted, stopped, or removed, the corresponding firewall rules are automatically cleaned.
|
||||||
- **Support for Published Ports:** Rules are auto-generated for any published ports, restricting incoming traffic to only the ports explicitly exposed via Docker.
|
- **Support for Published Ports:** Rules are auto-generated for any published ports, restricting incoming traffic to only the ports explicitly exposed via Docker.
|
||||||
|
|
||||||
## Install
|
|
||||||
To make the installation easy, I provide a package for Debian-based distros, follow the instructions here: [https://git.marcorealacci.me/marcorealacci/-/packages/debian/magicfw-docker](https://git.marcorealacci.me/marcorealacci/-/packages/debian/magicfw-docker)
|
|
||||||
|
|
||||||
To install the script manually, the required dependencies are `python3` and the `docker` library available from PyPI (`pip3 install docker`).
|
|
||||||
|
|
||||||
## Configuration
|
## Configuration
|
||||||
|
|
||||||
### Environment Variables
|
### Environment Variables
|
||||||
|
@ -61,11 +56,13 @@ services:
|
||||||
labels:
|
labels:
|
||||||
magicfw.firewall.allow_icc: "true"
|
magicfw.firewall.allow_icc: "true"
|
||||||
magicfw.firewall.allow_external: "true"
|
magicfw.firewall.allow_external: "true"
|
||||||
|
ports:
|
||||||
|
- 8080:80
|
||||||
```
|
```
|
||||||
|
|
||||||
In the above example:
|
In the above example:
|
||||||
- The `web` container can communicate with other containers on different Docker networks (`magicfw.firewall.allow_icc: true`).
|
- The `web` container can communicate with other containers on different Docker networks (`magicfw.firewall.allow_icc: true`).
|
||||||
- The container can be accessed by external hosts using the container's IP (**not host IP!**) (`magicfw.firewall.allow_external: true`). This requires a route on other hosts or the router.
|
- The container can be accessed by external hosts using the container's IP (`magicfw.firewall.allow_external: true`).
|
||||||
|
|
||||||
#### Example 2
|
#### Example 2
|
||||||
```yaml
|
```yaml
|
||||||
|
@ -95,7 +92,7 @@ services:
|
||||||
|
|
||||||
In the above example:
|
In the above example:
|
||||||
- The `web` container can communicate with other containers on different Docker networks (`magicfw.firewall.allow_icc: true`).
|
- The `web` container can communicate with other containers on different Docker networks (`magicfw.firewall.allow_icc: true`).
|
||||||
- External hosts can access the container via both <container IP>:80 and <host IP>:8080 (port mapping still works even with `DISABLE_NAT` set to `true`, as only Source NAT will be disabled)
|
- External hosts can access the container via both <container IP>:80 and <host IP>:8080 (port mapping still works even with DISABLE_NAT)
|
||||||
- External hosts will not be able to access the container on ports other than 80
|
- External hosts will not be able to access the container on ports other than 80
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue