gdm85 / docker-fw Goto Github PK

https://github.com/gdm85/docker-fw/blob/master/example-iptables.txt doesn't lead anywhere

It is proposed to add two extra commands:

• save (with optional specification of which container to save), that would export all ready-to-run commands (with --from-file)
• show, that would expose all current iptables rules with docker container names in place of IPv4 addresses

[root@monitor ~]# git clone https://github.com/gdm85/docker-fw.git
Cloning into 'docker-fw'...
remote: Counting objects: 208, done.
remote: Compressing objects: 100% (14/14), done.
remote: Total 208 (delta 59), reused 54 (delta 54), pack-reused 140
Receiving objects: 100% (208/208), 69.56 KiB | 0 bytes/s, done.
Resolving deltas: 100% (135/135), done.
[root@monitor ~]# cd docker-fw/
[root@monitor docker-fw]# ./build.sh
package github.com/docker/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar
imports github.com/docker/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar
imports github.com/docker/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar: cannot find package "github.com/docker/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar" in any of:
/usr/lib/golang/src/github.com/docker/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar (from $GOROOT)
/root/goroot/src/github.com/docker/docker/vendor/src/code.google.com/p/go/src/pkg/archive/tar (from $GOPATH)
[root@monitor docker-fw]#

Hi,

This is a question of a higher-level pattern. I understand docker-fw easily gives access to firewall configuration for ip+port+protocol, but what if I have a consul setup together with registrator and all containers are tagged with their respective services/roles? Is there an easy way to bind the real-time health checks of consul and registrator together with docker-fw to automatically add/remove firewall rules when containers are added and removed?

I'll admit that my knowledge of how iptables works is a bit low, but essentially what I'd like to do is accept connections on a new port for a docker container that was not started with either -P or -p. Is it possible to use docker-fw to do that, and if so, how?