<p>I have enabled the privileged mode in the container and add a rule to it,</p>

<pre><code>iptables -N udp2rawDwrW_191630ce_C0
iptables -F udp2rawDwrW_191630ce_C0
iptables -I udp2rawDwrW_191630ce_C0 -j DROP
iptables -I INPUT -p tcp -m tcp --dport 4096 -j udp2rawDwrW_191630ce_C0
</code></pre>

<p>and <code>kt exec</code> into the container and use <code>iptables --table filter -L</code>, I can see the added rules.</p>

<pre><code>/ # iptables --table filter -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
udp2rawDwrW_191630ce_C0  tcp  --  anywhere             anywhere             tcp dpt:4096

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain udp2rawDwrW_191630ce_C0 (1 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere
</code></pre>

<p>While when I logged into the node where the container lives, and run <code>sudo iptalbes --table filter -L</code>, I cannot see the same result.</p>

<p>I was thinking by default the <code>previleged</code> is dropped because the container might leverage it to change something like the iptables in the node, however it looks not like that.</p>

<p>So my question is "what is the relationship between K8S iptables and the one of a container inside a pod" and "why we stop user from modifying the container's iptables without the <code>privileged</code> field"?</p>

Damon Yuan
<p>if you want to manipulate node's iptables then you definitely need to put the pod on host's network (<code>hostNetwork: true</code> within pod's <code>spec</code>). After that granting to the container <code>NET_ADMIN</code> and <code>NET_RAW</code> capabilities (in <code>containers[i].securityContext.capabilities.add</code>) is sufficient.
example json slice:</p>

<pre><code>  "spec": {
    "hostNetwork": true,
    "containers": [{
      "name": "netadmin",
      "securityContext": {"capabilities": { "add": ["NET_ADMIN", "NET_RAW"] } }
</code></pre>

<p>I'm not sure if privileged mode has anything to do with manipulating host's iptables these days.</p>
