{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/23022","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/23022/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/23022/comments","events_url":"https://api.github.com/repos/docker/docker/issues/23022/events","html_url":"https://github.com/docker/docker/pull/23022","id":157025107,"number":23022,"title":"Use IPVS for nating instead of iptables","user":{"login":"cpuguy83","id":799078,"avatar_url":"https://avatars.githubusercontent.com/u/799078?v=3","gravatar_id":"","url":"https://api.github.com/users/cpuguy83","html_url":"https://github.com/cpuguy83","followers_url":"https://api.github.com/users/cpuguy83/followers","following_url":"https://api.github.com/users/cpuguy83/following{/other_user}","gists_url":"https://api.github.com/users/cpuguy83/gists{/gist_id}","starred_url":"https://api.github.com/users/cpuguy83/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cpuguy83/subscriptions","organizations_url":"https://api.github.com/users/cpuguy83/orgs","repos_url":"https://api.github.com/users/cpuguy83/repos","events_url":"https://api.github.com/users/cpuguy83/events{/privacy}","received_events_url":"https://api.github.com/users/cpuguy83/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/status/1-design-review","name":"status/1-design-review","color":"fef2c0"},{"url":"https://api.github.com/repos/docker/docker/labels/status/failing-ci","name":"status/failing-ci","color":"888888"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":12,"created_at":"2016-05-26T16:29:23Z","updated_at":"2016-07-14T16:05:56Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/23022","html_url":"https://github.com/docker/docker/pull/23022","diff_url":"https://github.com/docker/docker/pull/23022.diff","patch_url":"https://github.com/docker/docker/pull/23022.patch"},"body":"This is a POC using IPVS to setup port forwards (nat) rather than using\r\niptables.\r\nUsing iptables for setting up nat rules has a nasty tendancy to conflict\r\nwith user-defined firewall rules, and tend to be invisible to tools like\r\nUFW.\r\nMeanwhile using ipvs for nat is fairly natural and does not require\r\nmucking around in iptables rules.\r\n\r\nThe one thing we do need to continue using iptables for here is nating\r\nagainst localhost, however this shouldn't intefere with user-defined\r\nrules unless they are denying localhost (not likely)... and still much\r\nbetter than having public interfaces here.\r\n\r\nAlso fixes the known issue where if `--userland-proxy=false` nothing is binding to the host port, whereas ipvs does the binding.\r\n\r\nKnown issues as implemented:\r\n\r\n- Hairpin (i.e. from container -> natted port on host) is broken\r\n- Currently using ipvsadm for this POC, should use netlink\r\n- ipvs does not support `0.0.0.0`, so IPs must be read from the host\r\n  interfaces and each address will require a call to ipvs.\r\n\r\nFixes #4737\r\nFixes #22054\r\nFixes #14435\r\n\r\nSigned-off-by: Brian Goff <cpuguy83@gmail.com>"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/232711678","html_url":"https://github.com/docker/docker/pull/23022#issuecomment-232711678","issue_url":"https://api.github.com/repos/docker/docker/issues/23022","id":232711678,"user":{"login":"thaJeztah","id":1804568,"avatar_url":"https://avatars.githubusercontent.com/u/1804568?v=3","gravatar_id":"","url":"https://api.github.com/users/thaJeztah","html_url":"https://github.com/thaJeztah","followers_url":"https://api.github.com/users/thaJeztah/followers","following_url":"https://api.github.com/users/thaJeztah/following{/other_user}","gists_url":"https://api.github.com/users/thaJeztah/gists{/gist_id}","starred_url":"https://api.github.com/users/thaJeztah/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/thaJeztah/subscriptions","organizations_url":"https://api.github.com/users/thaJeztah/orgs","repos_url":"https://api.github.com/users/thaJeztah/repos","events_url":"https://api.github.com/users/thaJeztah/events{/privacy}","received_events_url":"https://api.github.com/users/thaJeztah/received_events","type":"User","site_admin":false},"created_at":"2016-07-14T16:05:56Z","updated_at":"2016-07-14T16:05:56Z","body":"@cpuguy83 what's the status on this one? Is this something we should try to get into 1.13 experimental?"}}
{"actor":{"display_login":"thaJeztah"}}