Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2023-09-08 Thread Shai Berger
Package: docker.io Followup-For: Bug #865975 Dear Maintainer, I come here with a different use-case. I use Debian on a desktop, in a room where the home wifi is weak. The desktop is connected by wire, but also has a wireless network adapter, so I set up a hotspot for my phone -- using tools from

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2023-02-21 Thread Per Lundberg
Hi Shengjing Zhu, On 2023-02-21 11:44, Shengjing Zhu wrote: Please read message#91 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=865975#91 and then think about it. If you still think there's a secure patch that we can apply, I'd like to review. Hmm, you have some very valid points and

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2023-02-21 Thread Shengjing Zhu
On Tue, Feb 21, 2023 at 5:03 PM Per Lundberg wrote: > > Regretfully, this bug is still active and it's trivial to reproduce with > this configuration: > > * apt-get install docker.io (ensure that the docker daemon is running > afterwards. Tested with 20.10.22+dfsg1-2 locally) > * apt-get install

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2023-02-21 Thread Per Lundberg
Regretfully, this bug is still active and it's trivial to reproduce with this configuration: * apt-get install docker.io (ensure that the docker daemon is running afterwards. Tested with 20.10.22+dfsg1-2 locally) * apt-get install lxd (tested with 5.0.1-5) Then, "lxc launch ubuntu:22.04"

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2019-06-24 Thread Jonathan Dowland
Hi Shengjing Zhu (et al) I've just (finally) attempted to reproduce this on my Buster host, but could not on this attempt. Libvirtd did not change my ip_forward setting from 0 to 1 in the test, but I had to do so manually to re-enable VM networking outside of the host (I don't think I did this

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2019-06-18 Thread Jonathan Dowland
On Mon, Jun 17, 2019 at 07:26:04PM +0800, Shengjing Zhu wrote: Please do think more about this issue. And understand why docker does this for the security reason. I understand the security issue. I understand why it does it. But if its the case that this does break unrelated software, i.e., if

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2019-06-17 Thread Shengjing Zhu
On Mon, Jun 17, 2019 at 5:56 PM Jonathan Dowland wrote: > > On Mon, Jun 17, 2019 at 04:22:30AM +0800, Shengjing Zhu wrote: > >Control: severity -1 normal > > > >On Tue, Jun 11, 2019 at 6:09 PM Shengjing Zhu wrote: > >> I checked more carefully on https://github.com/moby/moby/pull/28257 > >> and

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2019-06-17 Thread Jonathan Dowland
On Mon, Jun 17, 2019 at 04:22:30AM +0800, Shengjing Zhu wrote: Control: severity -1 normal On Tue, Jun 11, 2019 at 6:09 PM Shengjing Zhu wrote: I checked more carefully on https://github.com/moby/moby/pull/28257 and https://github.com/moby/moby/issues/14041 Then I concluded that docker does

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2019-06-17 Thread Jonathan Dowland
On Mon, Jun 17, 2019 at 09:16:18AM +0700, Arnaud Rebillout wrote: I will, and can even go further and display an explicit message when user upgrade the package maybe? (I'm not sure how to do that but I'm sure I'll find an example easily). That, in particular I think is a bad idea. It seems

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2019-06-16 Thread Shengjing Zhu
On Mon, Jun 17, 2019 at 10:16 AM Arnaud Rebillout wrote: > Hi, > > I will, and can even go further and display an explicit message when > user upgrade the package maybe? (I'm not sure how to do that but I'm > sure I'll find an example easily). docker.io already has a NEWS file, you can just

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2019-06-16 Thread Arnaud Rebillout
On 6/17/19 3:22 AM, Shengjing Zhu wrote: > Control: severity -1 normal > > On Tue, Jun 11, 2019 at 6:09 PM Shengjing Zhu wrote: >> Hi, >> >> I checked more carefully on https://github.com/moby/moby/pull/28257 >> and https://github.com/moby/moby/issues/14041 >> Then I concluded that docker does

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2019-06-16 Thread Shengjing Zhu
Control: severity -1 normal On Tue, Jun 11, 2019 at 6:09 PM Shengjing Zhu wrote: > > Hi, > > I checked more carefully on https://github.com/moby/moby/pull/28257 > and https://github.com/moby/moby/issues/14041 > Then I concluded that docker does nothing wrong in this case. > [...] With the

Bug#865975: docker.io changes iptables default FORWARD policy to DROP, breaks VM and others

2019-06-11 Thread Shengjing Zhu
Hi, I checked more carefully on https://github.com/moby/moby/pull/28257 and https://github.com/moby/moby/issues/14041 Then I concluded that docker does nothing wrong in this case. If you didn't set net.ipv4.ip_forward=1 before starting docker, then docker will set this for you by default,