{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/23854","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/23854/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/23854/comments","events_url":"https://api.github.com/repos/docker/docker/issues/23854/events","html_url":"https://github.com/docker/docker/issues/23854","id":161676448,"number":23854,"title":"Block traffic to external ip without privileged mode","user":{"login":"jtblin","id":1388974,"avatar_url":"https://avatars.githubusercontent.com/u/1388974?v=3","gravatar_id":"","url":"https://api.github.com/users/jtblin","html_url":"https://github.com/jtblin","followers_url":"https://api.github.com/users/jtblin/followers","following_url":"https://api.github.com/users/jtblin/following{/other_user}","gists_url":"https://api.github.com/users/jtblin/gists{/gist_id}","starred_url":"https://api.github.com/users/jtblin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jtblin/subscriptions","organizations_url":"https://api.github.com/users/jtblin/orgs","repos_url":"https://api.github.com/users/jtblin/repos","events_url":"https://api.github.com/users/jtblin/events{/privacy}","received_events_url":"https://api.github.com/users/jtblin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/docker/docker/labels/version/1.11","name":"version/1.11","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-06-22T13:03:31Z","updated_at":"2016-06-23T11:10:27Z","closed_at":null,"body":"<!--\r\nIf you are reporting a new issue, make sure that we do not have any duplicates\r\nalready open. You can ensure this by searching the issue list for this\r\nrepository. If there is a duplicate, please close your issue and add a comment\r\nto the existing issue instead.\r\n\r\nIf you suspect your issue is a bug, please edit your issue description to\r\ninclude the BUG REPORT INFORMATION shown below. If you fail to provide this\r\ninformation within 7 days, we cannot debug your issue and will close it. We\r\nwill, however, reopen it if you later provide the information.\r\n\r\nFor more information about reporting issues, see\r\nhttps://github.com/docker/docker/blob/master/CONTRIBUTING.md#reporting-other-issues\r\n\r\n---------------------------------------------------\r\nBUG REPORT INFORMATION\r\n---------------------------------------------------\r\nUse the commands below to provide key information from your environment:\r\nYou do NOT have to include this information if this is a FEATURE REQUEST\r\n-->\r\n\r\n**Output of `docker version`:**\r\n\r\n```\r\nClient:\r\n Version:      1.11.2\r\n API version:  1.23\r\n Go version:   go1.6.2\r\n Git commit:   b9f10c9\r\n Built:        Thu Jun  2 03:53:12 UTC 2016\r\n OS/Arch:      darwin/amd64\r\n\r\nServer:\r\n Version:      1.11.2\r\n API version:  1.23\r\n Go version:   go1.5.4\r\n Git commit:   b9f10c9\r\n Built:        Wed Jun  1 21:20:08 2016\r\n OS/Arch:      linux/amd64\r\n```\r\n\r\n\r\n**Output of `docker info`:**\r\n\r\n```\r\nContainers: 18\r\n Running: 0\r\n Paused: 0\r\n Stopped: 18\r\nImages: 83\r\nServer Version: 1.11.2\r\nStorage Driver: aufs\r\n Root Dir: /mnt/sda1/var/lib/docker/aufs\r\n Backing Filesystem: extfs\r\n Dirs: 110\r\n Dirperm1 Supported: true\r\nLogging Driver: json-file\r\nCgroup Driver: cgroupfs\r\nPlugins: \r\n Volume: local\r\n Network: null host bridge\r\nKernel Version: 4.4.12-boot2docker\r\nOperating System: Boot2Docker 1.11.2 (TCL 7.1); HEAD : a6645c3 - Wed Jun  1 22:59:51 UTC 2016\r\nOSType: linux\r\nArchitecture: x86_64\r\nCPUs: 1\r\nTotal Memory: 995.9 MiB\r\nName: default\r\nID: S3YO:RKQR:5M6N:P3VM:HJDV:3ROC:GJZD:UGYQ:VD45:MEDG:U4FF:HAF3\r\nDocker Root Dir: /mnt/sda1/var/lib/docker\r\nDebug mode (client): false\r\nDebug mode (server): true\r\n File Descriptors: 12\r\n Goroutines: 30\r\n System Time: 2016-06-22T12:59:53.896071089Z\r\n EventsListeners: 0\r\nUsername: jtblin\r\nRegistry: https://index.docker.io/v1/\r\nLabels:\r\n provider=virtualbox\r\n```\r\n\r\n**Additional environment details (AWS, VirtualBox, physical, etc.):**\r\nExample docker image\r\n```\r\nFROM alpine:3.4\r\n\r\nRUN apk --no-cache add \\\r\n\tgit \\\r\n\tiptables \\\r\n\tca-certificates\r\n\r\nADD entrypoint.sh /bin/entrypoint.sh\r\n\r\nENTRYPOINT [\"entrypoint.sh\"]\r\n```\r\n\r\n\r\n**Steps to reproduce the issue:**\r\nRun the following command inside a container that has `iptables` installed: \r\n\r\n    iptables -A OUTPUT -d 169.254.169.254 -j DROP\r\n\r\n\r\n**Describe the results you received:**\r\nI get the following error: \r\n\r\n> iptables v1.6.0: can't initialize iptables table `filter': Permission denied (you must be root)\r\n\r\n\r\n**Describe the results you expected:**\r\nThis is related to #4424. I need to run an iptables command inside the docker container but I cannot use the `-privileged` option as it is a shared platform. I basically need to prevent traffic from inside the container which executes non trusted code to access the ec2 metadata API.\r\n\r\n**Additional information you deem important (e.g. issue happens only occasionally):**\r\n"},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/228018460","html_url":"https://github.com/docker/docker/issues/23854#issuecomment-228018460","issue_url":"https://api.github.com/repos/docker/docker/issues/23854","id":228018460,"user":{"login":"gordonsyme","id":1714741,"avatar_url":"https://avatars.githubusercontent.com/u/1714741?v=3","gravatar_id":"","url":"https://api.github.com/users/gordonsyme","html_url":"https://github.com/gordonsyme","followers_url":"https://api.github.com/users/gordonsyme/followers","following_url":"https://api.github.com/users/gordonsyme/following{/other_user}","gists_url":"https://api.github.com/users/gordonsyme/gists{/gist_id}","starred_url":"https://api.github.com/users/gordonsyme/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gordonsyme/subscriptions","organizations_url":"https://api.github.com/users/gordonsyme/orgs","repos_url":"https://api.github.com/users/gordonsyme/repos","events_url":"https://api.github.com/users/gordonsyme/events{/privacy}","received_events_url":"https://api.github.com/users/gordonsyme/received_events","type":"User","site_admin":false},"created_at":"2016-06-23T11:10:27Z","updated_at":"2016-06-23T11:10:27Z","body":"Related: https://github.com/docker/docker/issues/23897 "}}
{"actor":{"display_login":"gordonsyme"}}