This is what I found. docker iptables rules look like this:
$ sudo iptables -vL --line-numbers
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 DOCKER-USER all -- any any anywhere anywhere
2 0 0 DOCKER-ISOLATION-STAGE-1 all -- any any anywhere anywhere
...
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0 anywhere anywhere
2 0 0 DOCKER-ISOLATION-STAGE-2 all -- myiface0 !myiface0 anywhere anywhere
3 0 0 RETURN all -- any any anywhere anywhere
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
num pkts bytes target prot opt in out source destination
1 0 0 DROP all -- any docker0 anywhere anywhere
2 0 0 DROP all -- any myiface0 anywhere anywhere
3 0 0 RETURN all -- any any anywhere anywhere
Chain DOCKER-USER (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN all -- any any anywhere anywhere
First, it checks if a rule of the chain DOCKER-USER allows to decide between ACCEPT or DROP, then each connection between docker bridges is filtered by DOCKER-ISOLATION-STAGE-2 chain.
We can
Before launching docker-compose, I create the network as root:
#!/bin/bash
if ! docker network ls | grep my-network
then
docker network create \
--driver=bridge \
--subnet=172.18.0.0/16 \
--opt com.docker.network.bridge.name=myiface0 \
my-network
fi
iptables -t filter -F DOCKER-ISOLATION-STAGE-2
And in my docker-compose file:
services:
my-gitlab:
networks:
- my-network
...
...
networks:
my-network:
external: true