nftables: enable using env var#50049
Merged
vvoland merged 1 commit intomoby:masterfrom May 28, 2025
Merged
Conversation
Signed-off-by: Rob Murray <rob.murray@docker.com>
d035139 to
21a165d
Compare
Contributor
|
Do we want to have a release note for this one? |
Member
|
IIUC, (also per discussion on slack) this only allows enabling the bits that are still very much "work in progress", so not intended as user-facing change. It does no harm (without using the env-var), but likely not yet gives anything "testable" for users. |
Contributor
Author
Probably not ... the nftables implementation is still all queuing up for review, so the env-var doesn't actually do much yet (apart from make it easier to write tests and run nftables in the upcoming commits). |
vvoland
approved these changes
May 28, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Draft PR:
- What I did
For testing - if env var
DOCKER_FIREWALL_BACKEND=nftables, andnftis available, use the nftables backend instead of nftables.We'll need daemon options for controlling the backend, so we'll also need decide what to do about the existing options ... but this change isn't that ... it's just so we can set the env var to pick the backend for a CI run.
- How I did it
The firewalld handler is now initialised before network driver registration. So, make sure an
OnReloadedcallback isn't processed while the bridge driver is still setting up.- How to verify it
- Human readable description for the release notes
- A picture of a cute animal (not mandatory but encouraged)