netinst

func EnsureIptablesSymlinks ¶ added in v0.19.11

func EnsureIptablesSymlinks(ctx context.Context) error

EnsureIptablesSymlinks makes sure iptables/ip6tables resolve to the right backend.

func FirewalldRunning ¶

func FirewalldRunning(ctx context.Context) bool

FirewalldRunning reports whether firewalld answers on the system D-Bus. It is the check the CNI firewall plugin makes to manage container traffic through firewalld rather than iptables (plugins/meta/firewall, isFirewalldRunning). Any failure, including no system bus or no answer within the timeout, counts as not running.

func InstallCNIConfig ¶

func InstallCNIConfig(ctx context.Context, name, subnet string, firewallPlugin bool) (string, error)

InstallCNIConfig writes the engine's CNI config. firewallPlugin keeps the CNI firewall plugin, for networks firewalld manages; otherwise InstallSubnetRules accepts forwarded traffic for the whole subnet.

func InstallDnsmasq ¶

func InstallDnsmasq(ctx context.Context, name string) error

func InstallResolvconf ¶

func InstallResolvconf(name, containerDNS string) error

func InstallSubnetRules ¶

func InstallSubnetRules(ctx context.Context, name, cidr string, forward bool) error

InstallSubnetRules installs the masquerade rules for the engine's container network and, if forward is set, its forwarding rules. forward is unset when the CNI firewall plugin is kept because firewalld manages the network; then forwarding rules this network installed before are removed. It also removes per-container rules left by older engines in the same network namespace. It is idempotent.

Forwarding rules always go through the iptables command, as the CNI firewall plugin's did; EnsureIptablesSymlinks points it at the legacy or nft variant. Masquerading uses the same backend the bridge plugin would have used.