Суть такая: при сборке в docker compose (v2) контейнеров доступ к интернету в билдере отсутствует, в самих контейнерах всё ок, даже и хз куда копать. На iptables проблем вообще не было, неужели это лечится только гигантским списком ручных правил, ибо от сгенерированного страшно (а то и психану, уйду на NixOS..):
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
chain DOCKER {
iifname "docker0" counter packets 0 bytes 0 return
}
chain POSTROUTING {
type nat hook postrouting priority srcnat; policy accept;
oifname != "docker0" ip saddr 172.17.0.0/16 counter packets 0 bytes 0 xt target "MASQUERADE"
}
chain PREROUTING {
type nat hook prerouting priority dstnat; policy accept;
xt match "addrtype" counter packets 0 bytes 0 jump DOCKER
}
chain OUTPUT {
type nat hook output priority -100; policy accept;
ip daddr != 127.0.0.0/8 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER
}
}
# Warning: table ip filter is managed by iptables-nft, do not touch!
table ip filter {
chain DOCKER {
}
chain DOCKER-ISOLATION-STAGE-1 {
iifname "docker0" oifname != "docker0" counter packets 7 bytes 486 jump DOCKER-ISOLATION-STAGE-2
counter packets 7 bytes 486 return
}
chain DOCKER-ISOLATION-STAGE-2 {
oifname "docker0" counter packets 0 bytes 0 drop
counter packets 7 bytes 486 return
}
chain FORWARD {
type filter hook forward priority filter; policy drop;
counter packets 7 bytes 486 jump DOCKER-USER
counter packets 7 bytes 486 jump DOCKER-ISOLATION-STAGE-1
oifname "docker0" xt match "conntrack" counter packets 0 bytes 0 accept
oifname "docker0" counter packets 0 bytes 0 jump DOCKER
iifname "docker0" oifname != "docker0" counter packets 7 bytes 486 accept
iifname "docker0" oifname "docker0" counter packets 0 bytes 0 accept
}
chain DOCKER-USER {
counter packets 7 bytes 486 return
}
}
Вот мои собственные правила для общего фаервола на ноуте, с rootless podman и в других случаях работают прекрасно:
table inet filter {
chain input {
type filter hook input priority filter; policy drop;
ct state invalid drop comment "early invalid packets"
iif "lo" accept comment "any localhost traffic"
ct state { established, related } accept comment "traffic originated from us"
icmpv6 type { nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert } ip6 hoplimit 255 accept comment "ipv6 requires neighbour discovery"
}
chain forward {
type filter hook forward priority filter; policy drop;
}
}
