Struct ContainerToContainer 

pub struct ContainerToContainer {
    pub default_policy: ChainPolicy,
    pub same_network_verdict: Option<RuleVerdict>,
    pub rules: Option<Vec<ContainerToContainerRule>>,
}

The container-to-container section, defining how containers can communicate amongst each other.

Fields

default_policy: ChainPolicy

The default_policy defines the default for when there is not a specific rule.

Filtering traffic within the same bridge

Depending on how your host is configured, traffic whose origin and destination interface are the same bridge is not filtered by the kernel netfilter module. This means that this default policy is not honored for traffic between containers that are on the same Docker network, but only for traffic that traverses two bridges.

If your kernel has the br_netfilter kernel-module available, you can set the sysctl net.bridge.bridge-nf-call-iptables to 1 to have the netfilter-module act on traffic within the same bridge, too. You can set this value temporarily like this:

sysctl net.bridge.bridge-nf-call-iptables=1

To permanently set this configuration, take a look at man sysctl.d and man sysctl.conf.

same_network_verdict: Option<RuleVerdict>

Configure whether traffic between containers within the same network should be allowed or not.

This option is more specific than default_policy, applying to traffic between containers on the same network, rather than also applying across networks. This option has precedence over the default_policy for traffic on the same network.

Example

Setting the same_network_verdict to accept will allow all traffic between containers on the same network to pass, regardless of the default_policy configured:

[container_to_container]
default_policy = "drop"
same_network_verdict = "accept"

If you want to allow traffic between containers on the same networks in general, but want to restrict traffic on some networks, you can additionally add container-to-container rules to disallow traffic between containers for the desired networks:

[container_to_container]
default_policy = "drop"
same_network_verdict = "accept"

[[container_to_container.rules]]
network = "restricted_network"
verdict = "reject"

Host configuration

Depending on how your host is configured, traffic whose origin and destination interface are the same bridge (network) is not filtered by the kernel netfilter module.

This means that this verdict is only honored if your kernel has the br_netfilter kernel-module available and the sysctl net.bridge.bridge-nf-call-iptables is set to 1. Otherwise traffic between containers on the same network will always be allowed.

You can set the sysctl-value temporarily like this:

sysctl net.bridge.bridge-nf-call-iptables=1

To permanently set this configuration, take a look at man sysctl.d and man sysctl.conf.

rules: Option<Vec<ContainerToContainerRule>>

An optional list of rules, see ContainerToContainerRule.

Example

The easiest way to define the rules is using TOMLs arrays of tables:

[container_to_container]
default_policy = "drop"

[[container_to_container.rules]]
# first rule here
[[container_to_container.rules]]
# second rule here

Trait Implementations

impl Clone for ContainerToContainer

fn clone(&self) -> ContainerToContainer

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ContainerToContainer

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ContainerToContainer

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for ContainerToContainer

impl Hash for ContainerToContainer

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for ContainerToContainer

fn eq(&self, other: &ContainerToContainer) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Process<Iptables> for ContainerToContainer

fn process( &self, ctx: &ProcessContext<'_, Iptables>, ) -> Result<Option<Vec<IptablesRule>>>

Process the current type within the given ProcessContext, returning zero or more rules to apply with nft.

impl Process<Nftables> for ContainerToContainer

fn process( &self, ctx: &ProcessContext<'_, Nftables>, ) -> Result<Option<Vec<String>>>

Process the current type within the given ProcessContext, returning zero or more rules to apply with nft.

impl StructuralPartialEq for ContainerToContainer