Containers can talk to the host over the network even with ICC disabled #21990
Description
Output of docker version:
ubuntu@execute-1460530807:~$ docker version
Client:
Version: 1.11.0-rc5
API version: 1.23
Go version: go1.5.3
Git commit: 6178547
Built: Mon Apr 11 21:07:24 2016
OS/Arch: linux/amd64
Server:
Version: 1.11.0-rc5
API version: 1.23
Go version: go1.5.3
Git commit: 6178547
Built: Mon Apr 11 21:07:24 2016
OS/Arch: linux/amd64
Output of docker info:
ubuntu@execute-1460530807:~$ docker info
Containers: 17
Running: 17
Paused: 0
Stopped: 0
Images: 23
Server Version: 1.11.0-rc5
Storage Driver: overlay
Backing Filesystem: extfs
Logging Driver: none
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge null host
Kernel Version: 3.19.0-58-generic
Operating System: Ubuntu 14.04.4 LTS
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 29.45 GiB
Name: execute-1460530807
ID: PQ6T:3IL3:XDMV:KKFC:TAJN:MDAO:6T6K:SSO4:L3YQ:LIDK:NNPZ:6J5U
Docker Root Dir: /var/lib/docker
Debug mode (client): false
Debug mode (server): false
Registry: https://index.docker.io/v1/
WARNING: No swap limit support
Additional environment details (AWS, VirtualBox, physical, etc.):
GCE
Steps to reproduce the issue:
Setup a docker host that also happens to be listening on whatever ports:
ubuntu@execute-1460530807:~$ sudo netstat -plnt
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1204/sshd
tcp6 0 0 :::42069 :::* LISTEN 5017/node
tcp6 0 0 :::22 :::* LISTEN 1204/sshd
Make sure that ICC is OFF:
ubuntu@execute-1460530807:~$ cat /etc/default/docker
DOCKER_OPTS="-s overlay --icc=false --log-driver=none"
Try to run a container that scans local available ports:
ubuntu@execute-1460530807:~$ docker run --rm -t us.gcr.io/coderpad-1189/coderpad:base /bin/bash -c "nc -vz 172.17.0.1 1-65535 2>&1 | grep succeeded"
Connection to 172.17.0.1 22 port [tcp/ssh] succeeded!
Connection to 172.17.0.1 42069 port [tcp/*] succeeded!
Describe the results you received:
The container was able to see and interact with the host over the local bridge.
Describe the results you expected:
It is a strategic question whether to leave --icc=true or change it to --icc=false so that iptables will protect other containers -- and the main host -- from having arbitrary ports probed or accessed by a container that gets compromised.
which suggests that this behavior should not occur with ICC disabled.