#docker

/

      • yybel joined the channel
      • alpha_ has quit
      • ascarter has quit
      • yardenbar joined the channel
      • pawky
        TinoDidriksen: how do you mean fully controlled by the docker service?, isnt it fully controlled by the host os?
      • TinoDidriksen
        Sure, but docker adds and removed rules at will when you start/stop containers and the service itself.
      • pawky
        and has it done so correctly?
      • WalterTamboer has quit
      • WalterTamboer joined the channel
      • berton joined the channel
      • WalterTamboer has quit
      • WalterTamboer joined the channel
      • hs366 joined the channel
      • gtt joined the channel
      • TinoDidriksen
        ...no. Or at best maybe. The NAT Output rule does not forward to Docker's rewriting if the data is coming over localhost - if I go over the public IP, then it works. Ok then. How bizarre.
      • ziyourenxiang joined the channel
      • pawky
        case closed? :-)
      • pt1 joined the channel
      • TinoDidriksen
        That depends on whether this is documented. I find it surprising that forwarding over localhost doesn't work, and couldn't find anything about this on Google for the past hours.
      • scl joined the channel
      • pawky
        well... its localhost.
      • scl has quit
      • i presume the docker container talks to itself its own localhost then.
      • TinoDidriksen
        It's rewriting input correctly, but explicitly doesn't rewrite output. If localhost input is not special, why is localhost output?
      • pawky
        if you want it to talk to other containers or the host you better use their ip addresses.
      • TinoDidriksen
        Nah, I just wanted to test a container before shipping it, and couldn't make it yield any output...
      • pawky
        use different IP? :-)
      • pt1 has quit
      • emilisto joined the channel
      • beautifulmind has quit
      • TinoDidriksen
        Sure sure, just still surprising behavior. But yeah, case closed, with footnote.
      • pawky
        your welcome :-)
      • scl joined the channel
      • but its not that much of a strange behaviour
      • qt-x has quit
      • even containers do probably have their on loopback interface
      • mmars joined the channel
      • you dont want loop back interfaces of different containers or host to talk intermediately with each other, as then its not a loop back network anymore
      • grayhemp joined the channel
      • neogan74 has quit
      • but I presume you ought to be able to use the loopback driver if running two services who wants to communicate with each other in the same container.
      • I gues though thats not what you want.
      • TinoDidriksen
        The actual rule is that all host output is NAT'ed except it destination matches 127.0.0.0/8 - the only place in the documentation that mentions 127.0.0.0/8 is to do with registries.
      • *if
      • Rodya_ joined the channel
      • pawky
        wouldnt you say it would be a bit pointless doing nat rules on the loopback interface?
      • umpc joined the channel
      • IDrinkMilk has quit
      • TinoDidriksen
        It's doing it on the input. That's what I dislike - it's 50% working. Input goes through, but output is dropped.
      • If it was 100% blocked, that'd be easier to debug.
      • pawky
        didnt you say the input came from the host?