{"action":"closed","issue":{"url":"https://api.github.com/repos/docker/docker/issues/26724","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/26724/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/26724/comments","events_url":"https://api.github.com/repos/docker/docker/issues/26724/events","html_url":"https://github.com/docker/docker/issues/26724","id":177897856,"number":26724,"title":"Disabling ICC on internal network does not work","user":{"login":"duffsterlp","id":5368884,"avatar_url":"https://avatars.githubusercontent.com/u/5368884?v=3","gravatar_id":"","url":"https://api.github.com/users/duffsterlp","html_url":"https://github.com/duffsterlp","followers_url":"https://api.github.com/users/duffsterlp/followers","following_url":"https://api.github.com/users/duffsterlp/following{/other_user}","gists_url":"https://api.github.com/users/duffsterlp/gists{/gist_id}","starred_url":"https://api.github.com/users/duffsterlp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/duffsterlp/subscriptions","organizations_url":"https://api.github.com/users/duffsterlp/orgs","repos_url":"https://api.github.com/users/duffsterlp/repos","events_url":"https://api.github.com/users/duffsterlp/events{/privacy}","received_events_url":"https://api.github.com/users/duffsterlp/received_events","type":"User","site_admin":false},"labels":[{"id":237472034,"url":"https://api.github.com/repos/docker/docker/labels/area/networking","name":"area/networking","color":"fbca04","default":false},{"id":375714123,"url":"https://api.github.com/repos/docker/docker/labels/version/1.12","name":"version/1.12","color":"ededed","default":false}],"state":"closed","locked":false,"assignee":{"login":"aboch","id":10080882,"avatar_url":"https://avatars.githubusercontent.com/u/10080882?v=3","gravatar_id":"","url":"https://api.github.com/users/aboch","html_url":"https://github.com/aboch","followers_url":"https://api.github.com/users/aboch/followers","following_url":"https://api.github.com/users/aboch/following{/other_user}","gists_url":"https://api.github.com/users/aboch/gists{/gist_id}","starred_url":"https://api.github.com/users/aboch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aboch/subscriptions","organizations_url":"https://api.github.com/users/aboch/orgs","repos_url":"https://api.github.com/users/aboch/repos","events_url":"https://api.github.com/users/aboch/events{/privacy}","received_events_url":"https://api.github.com/users/aboch/received_events","type":"User","site_admin":false},"assignees":[{"login":"aboch","id":10080882,"avatar_url":"https://avatars.githubusercontent.com/u/10080882?v=3","gravatar_id":"","url":"https://api.github.com/users/aboch","html_url":"https://github.com/aboch","followers_url":"https://api.github.com/users/aboch/followers","following_url":"https://api.github.com/users/aboch/following{/other_user}","gists_url":"https://api.github.com/users/aboch/gists{/gist_id}","starred_url":"https://api.github.com/users/aboch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aboch/subscriptions","organizations_url":"https://api.github.com/users/aboch/orgs","repos_url":"https://api.github.com/users/aboch/repos","events_url":"https://api.github.com/users/aboch/events{/privacy}","received_events_url":"https://api.github.com/users/aboch/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/docker/docker/milestones/56","html_url":"https://github.com/docker/docker/milestones/1.13.0","labels_url":"https://api.github.com/repos/docker/docker/milestones/56/labels","id":1839404,"number":56,"title":"1.13.0","description":"","creator":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"open_issues":112,"closed_issues":578,"state":"open","created_at":"2016-06-20T22:51:25Z","updated_at":"2016-11-03T21:35:28Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2016-09-19T21:05:23Z","updated_at":"2016-11-03T21:35:28Z","closed_at":"2016-11-03T21:35:28Z","body":"<!--\nIf you are reporting a new issue, make sure that we do not have any duplicates\nalready open. You can ensure this by searching the issue list for this\nrepository. If there is a duplicate, please close your issue and add a comment\nto the existing issue instead.\n\nIf you suspect your issue is a bug, please edit your issue description to\ninclude the BUG REPORT INFORMATION shown below. If you fail to provide this\ninformation within 7 days, we cannot debug your issue and will close it. We\nwill, however, reopen it if you later provide the information.\n\nFor more information about reporting issues, see\nhttps://github.com/docker/docker/blob/master/CONTRIBUTING.md#reporting-other-issues\n\n---------------------------------------------------\nBUG REPORT INFORMATION\n---------------------------------------------------\nUse the commands below to provide key information from your environment:\nYou do NOT have to include this information if this is a FEATURE REQUEST\n-->\n\n**Description**\n\nI am trying to understand how to limit communication between Docker containers on the same network. Disabling ICC in the daemon, disabling IP forwarding, flushing the forward chain on the host's iptables and dropping all forwarded packets, and disabling ICC in the network doesn't prevent this. The issue that I see is that pings still propagate from one container to another when both containers are attached to a custom bridge network. \n\n**Steps to reproduce the issue:**\n1. Flush forwarding chain of iptables on host and setting it to drop all packets\n2. Start docker daemon with ICC set to false and IP forwarding set to false\n3. Create custom bridge network with ICC disabled and which is an internal network\n4. Spawn 2 containers attached to the custom network\n5. Ping from one hostname to the other\n\n**Describe the results you received:**\nPings are oddly successful between the containers. \n\n**Describe the results you expected:**\nPings should not go through because ICC is disabled on the network.\n\n**Additional information you deem important (e.g. issue happens only occasionally):**\nI'm really just trying to understand what these different options should do and whether they are behaving as expected. In addition, I am trying to understand why the packets aren't hitting the host's iptables. \n\nI did see this issue:\nhttps://github.com/docker/docker/issues/21990\nbut it only seemed to apply for the ICC flag in the daemon whereas I'm also considering the ICC flag in the network as well.\n\n**Output of `docker version`:**\n\n```\nClient:\n Version:      1.12.1\n API version:  1.24\n Go version:   go1.6.3\n Git commit:   23cf638\n Built:\n OS/Arch:      linux/amd64\n\nServer:\n Version:      1.12.1\n API version:  1.24\n Go version:   go1.6.3\n Git commit:   23cf638\n Built:\n OS/Arch:      linux/amd64\n\n```\n\n**Output of `docker info`:**\n\n```\nContainers: 2\n Running: 2\n Paused: 0\n Stopped: 0\nImages: 7\nServer Version: 1.12.1\nStorage Driver: devicemapper\n Pool Name: docker-253:1-394705729-pool\n Pool Blocksize: 65.54 kB\n Base Device Size: 10.74 GB\n Backing Filesystem: xfs\n Data file: /dev/loop0\n Metadata file: /dev/loop1\n Data Space Used: 460.3 MB\n Data Space Total: 107.4 GB\n Data Space Available: 88.94 GB\n Metadata Space Used: 958.5 kB\n Metadata Space Total: 2.147 GB\n Metadata Space Available: 2.147 GB\n Thin Pool Minimum Free Space: 10.74 GB\n Udev Sync Supported: true\n Deferred Removal Enabled: false\n Deferred Deletion Enabled: false\n Deferred Deleted Device Count: 0\n Data loop file: /var/lib/docker/devicemapper/devicemapper/data\n WARNING: Usage of loopback devices is strongly discouraged for production use. Use `--storage-opt dm.thinpooldev` to specify a custom block storage device.\n Metadata loop file: /var/lib/docker/devicemapper/devicemapper/metadata\n Library Version: 1.02.107-RHEL7 (2016-06-09)\nLogging Driver: json-file\nCgroup Driver: cgroupfs\nPlugins:\n Volume: local\n Network: null bridge host overlay\nSwarm: inactive\nRuntimes: runc\nDefault Runtime: runc\nSecurity Options: seccomp\nKernel Version: 3.10.0-229.el7.x86_64\nOperating System: CentOS Linux 7 (Core)\nOSType: linux\nArchitecture: x86_64\nCPUs: 4\nTotal Memory: 7.797 GiB\nName: glenntest.novalocal\nID: G37T:BQMP:MOF5:NI5M:CEWW:XLFG:OWIX:5ZZN:QQXF:BTCX:PAZP:RO5D\nDocker Root Dir: /var/lib/docker\nDebug Mode (client): false\nDebug Mode (server): false\nRegistry: https://index.docker.io/v1/\nWARNING: IPv4 forwarding is disabled\nWARNING: bridge-nf-call-iptables is disabled\nWARNING: bridge-nf-call-ip6tables is disabled\nInsecure Registries:\n 127.0.0.0/8\n```\n\n**Additional environment details (AWS, VirtualBox, physical, etc.):** Seen on openstack instance as well as a vSphere virtual machine\n"}}
{"actor":{"display_login":"mavenugo"}}