Re: firewalld in atomic host
On 04/21/2017 10:16 AM, Dusty Mabe wrote: > NOTE: if you respond to this message please 'reply-all'. > > I'd like to discuss firewalld on atomic host. Recently I was trying to > figure out the best way to explain to other users how to set firewall rules > on atomic host. > > Usually I would say add your rules and then iptables-save, but on Atomic > Host docker has added it's firewall rules in there dynamically so if you > iptables-save > you'll get a bunch of stuff that you don't want in your static configuration. > > There are ways around this; manually create your config file, or use > iptables-save > and then rip the docker stuff out. Either way it's a bit of a pain. I think > firewalld would make this easier on the user. Not sure of the pro/con ratio > though. > reviving this old discussion: I am proposing we add firewalld do atomic host: https://pagure.io/atomic-wg/issue/372 ___ cloud mailing list -- cloud@lists.fedoraproject.org To unsubscribe send an email to cloud-le...@lists.fedoraproject.org
Re: firewalld in atomic host
On 04/21/2017 01:42 PM, Jason DeTiberus wrote: > > While I can see firewalld improving the situation wrt documenting how to > add/persist firewall changes for Atomic Host (especially when using > moby/docker), I think there is a bigger concern with firewalld being absent. > If a user is running multiple applications that modify the host firewall > (docker, Kubernetes, OpenShift, etc), firewalld provides a way to make > firewall modifications in a consistent and repeatable manner, where iptables > does not. There is the --wait flag for iptables, however any > applications/users that are interacting with iptables will need to ensure > they use it consistently. > So you are saying firewalld makes your life easier if it was available? Thanks for the input. Dusty ___ cloud mailing list -- cloud@lists.fedoraproject.org To unsubscribe send an email to cloud-le...@lists.fedoraproject.org
Re: [atomic-devel] firewalld in atomic host
On Fri, Apr 21, 2017, at 10:16 AM, Dusty Mabe wrote: > NOTE: if you respond to this message please 'reply-all'. > > I'd like to discuss firewalld on atomic host. I think there here are two cases: AH-as-Kube/OpenShift host: In this I'd turn the conversation around - do Kube/OpenShift want to depend on firewalld? This has come up before, see https://bugzilla.redhat.com/show_bug.cgi?id=1403331 Standalone/"pet" AH: I think that package layering solves this today (and other "pet" cases), and ideally we would also provide a container. Basically I don't have a definitive answer myself, but hopefully at least the above bz link is useful. ___ cloud mailing list -- cloud@lists.fedoraproject.org To unsubscribe send an email to cloud-le...@lists.fedoraproject.org
