New answers tagged

1

You have Docker which itself alters the firewall rules. I can't tell if that's because of Docker, but you have iptables' default policy for filter/FORWARD set to DROP preventing any routing not explicitly allowed. EDIT: added the return direction. To make your experiment work this should be enough (including the return traffic which must also be enabled): ...


2

After some trial and error, I found out that in fact CAP_SYS_PTRACE is needed. In contrast, CAP_DAC_READ_SEARCH and CAP_DAC_OVERRIDE don't give the required access, which includes readlink() and similar operations. What I'm seeing can be cross-checked: first, ptrace.c gives the necessary clue in __ptrace_may_access(): /* May we inspect the given task? * ...


0

I created a simple script that lists all containers with associated veth interface: https://github.com/samos123/docker-veth/blob/master/docker-veth.sh Let me explain how it works: Find the PID of the container pid=$(docker inspect --format '{{.State.Pid}}' $containerID) Enter the network namespace using nsenter nsenter -t $pid -n ip a You will notice ...


Top 50 recent answers are included