{"action":"closed","issue":{"url":"https://api.github.com/repos/docker/docker/issues/5434","labels_url":"https://api.github.com/repos/docker/docker/issues/5434/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/5434/comments","events_url":"https://api.github.com/repos/docker/docker/issues/5434/events","html_url":"https://github.com/docker/docker/issues/5434","id":32347420,"number":5434,"title":"Dealing with a strictly controlled firewall","user":{"login":"timstoop","id":729432,"avatar_url":"https://avatars.githubusercontent.com/u/729432?v=3","gravatar_id":"","url":"https://api.github.com/users/timstoop","html_url":"https://github.com/timstoop","followers_url":"https://api.github.com/users/timstoop/followers","following_url":"https://api.github.com/users/timstoop/following{/other_user}","gists_url":"https://api.github.com/users/timstoop/gists{/gist_id}","starred_url":"https://api.github.com/users/timstoop/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/timstoop/subscriptions","organizations_url":"https://api.github.com/users/timstoop/orgs","repos_url":"https://api.github.com/users/timstoop/repos","events_url":"https://api.github.com/users/timstoop/events{/privacy}","received_events_url":"https://api.github.com/users/timstoop/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2014-04-28T10:26:18Z","updated_at":"2015-02-25T18:52:18Z","closed_at":"2015-02-25T18:52:18Z","body":"Hi,\r\n\r\nWe'd like to use Docker in a setup where the firewall is strictly controlled by ferm via puppet. The trouble we're running into is that ferm needs all rules in its own config, any changes performed by external applications (like docker) will get removed by ferm when it reloads. Which is a bit of a problem when you've bound ports to docker containers.\r\n\r\nAside from disabling ferm entirely (which is sadly not an option in this environment), I see only three ways around that, all of them require changes in docker:\r\n\r\n1. Fixed IP addresses for docker containers, so we know in advance which port on which IP address needs to be masqueraded and we can add it to the ferm config statically.\r\n\r\n2. Add an option to docker that makes it reload it's firewall config and set it up anew. This would be slightly problematic, since it would break already running connections, but at least it would allow me to get the config.\r\n\r\n3. Make docker 'request' the firewall changes from some script that automagically creates the required ferm config and adds it in the ferm.d directory. Docker would invoke a script and sent its information in some format (json?) to the stdin of the script.\r\n\r\nThe first one is probably preferred, since it allows us to take the config change into account in config management (and thus, in version control). But maybe I'm overlooking already implemented solutions for this? On IRC it was recommended to simply open all the ports, but that's not an option.\r\n\r\nI'd appreciate some input to this problem."}}