add Phase 2B contained runtime artifacts
This commit is contained in:
parent
a9fec0d83d
commit
82e64cec43
35 changed files with 5177 additions and 40 deletions
|
|
@ -152,22 +152,22 @@ Current host observation and planning checkpoint:
|
||||||
- the default Docker context does not provide a usable daemon/security result to this user;
|
- the default Docker context does not provide a usable daemon/security result to this user;
|
||||||
- no enabled user-level rootless Docker service was detected;
|
- no enabled user-level rootless Docker service was detected;
|
||||||
- no persistent `le-app-codex` namespace or project nftables policy is deployed;
|
- no persistent `le-app-codex` namespace or project nftables policy is deployed;
|
||||||
- approved DNS remains unresolved; the host resolver currently includes `192.168.10.1`, which is an observation rather than approval;
|
- root inventory is complete; Quad9 IPv4 `9.9.9.9` and `149.112.112.112` are approved, while observed LAN resolver `192.168.10.1` remains denied with no LAN exception;
|
||||||
- numerous existing Docker IPv4 and IPv6 bridge ranges must be dynamically inventoried and denied rather than represented only by a stale list.
|
- numerous existing Docker IPv4 and IPv6 bridge ranges must be dynamically inventoried and denied rather than represented only by a stale list.
|
||||||
|
|
||||||
Therefore a `sol6_vi`-owned daemon is rejected: it could bind-mount those readable production secrets. Milestone 0 requires the isolated account and host changes described in `host-runtime-plan.md`, and work must stop before performing them. An administrator must approve/provision:
|
Therefore a `sol6_vi`-owned daemon is rejected: it could bind-mount those readable production secrets. Milestone 0 requires the isolated account and host changes described in `host-runtime-plan.md`, and work must stop before performing them. An administrator must approve/provision:
|
||||||
|
|
||||||
1. dedicated `le_app_codex` identity and restricted filesystem ACLs;
|
1. dedicated `le_app_codex` identity and restricted filesystem ACLs;
|
||||||
2. an explicitly selected package path: scheduled full host maintenance or a clean-chroot/current-system-compatible investigation, never a partial Arch upgrade;
|
2. the completed and verified Phase 2A package-maintenance baseline, without rerunning that transaction;
|
||||||
3. a checksum-pinned Moby rootless launcher matched to the installed Docker release, not the unmodified AUR extras package or its global sysctl hook;
|
3. a checksum-pinned Moby rootless launcher matched to the installed Docker release, not the unmodified AUR extras package or its global sysctl hook;
|
||||||
4. instance-specific containment on `user@1200.service`, the proposed `user-1200.slice` resource limits, and no lingering;
|
4. instance-specific containment on `user@1200.service`, the proposed `user-1200.slice` resource limits, and no lingering;
|
||||||
5. a root-created IPv4-only namespace with default-deny egress and dynamic denial of host, LAN, WireGuard, metadata, private, loopback, Docker bridge, SMTP, and IPv6 access;
|
5. a root-created IPv4-only namespace with default-deny egress and dynamic denial of host, LAN, WireGuard, metadata, private, loopback, Docker bridge, SMTP, and IPv6 access;
|
||||||
6. inert acceptance tests before starting the user manager, Docker, or Codex;
|
6. inert acceptance tests before starting the user manager, Docker, or Codex;
|
||||||
7. deterministic CPU BGBye first; optional GPU access only after core acceptance;
|
7. deterministic CPU BGBye first; optional GPU access only after core acceptance;
|
||||||
8. user/browser-profile-scoped development CA trust;
|
8. user/browser-profile-scoped development CA trust;
|
||||||
9. a separately approved disk-growth limit for images, caches, snapshots, media, PostgreSQL, and test artifacts.
|
9. deferred hard disk-growth enforcement for images, caches, snapshots, media, PostgreSQL, and test artifacts; this is not a Phase 2B installation blocker and existing visibility/resource controls are not a hard quota.
|
||||||
|
|
||||||
Lingering must remain disabled. No production socket forwarding, Docker-group membership, broad sudo rule, daemon TCP exposure, system-service `dockerd`, or bind mount into production paths is acceptable. See `host-runtime-plan.md` for the approval-gated lifecycle and unresolved DNS, address-inventory, authentication, package, and disk-quota decisions.
|
Lingering must remain disabled. No production socket forwarding, Docker-group membership, broad sudo rule, daemon TCP exposure, system-service `dockerd`, or bind mount into production paths is acceptable. See `host-runtime-plan.md` for the approval-gated lifecycle, deferred nonblocking storage quota, and unresolved authentication decision.
|
||||||
|
|
||||||
## One-command workflows
|
## One-command workflows
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
# Milestone 0 host runtime and security plan
|
# Milestone 0 host runtime and security plan
|
||||||
|
|
||||||
Status: corrected planning checkpoint, 2026-07-12. Nothing in this document authorizes execution. Phase 1 created only the inert `le_app_codex` identity and directory skeleton. Package installation, systemd changes, namespace creation, firewall changes, user-manager startup, Docker startup, Codex authentication, repository/source copying, and production changes remain separately approval-gated.
|
Status: Phase 2A completed and verified, 2026-07-12; Phase 2B is review-only. Nothing in this document authorizes Phase 2B execution. Phase 1 created only the inert `le_app_codex` identity and directory skeleton. Phase 2B systemd changes, namespace creation, firewall changes, user-manager startup, Docker startup, Codex authentication, repository/source copying, and production changes remain separately approval-gated.
|
||||||
|
|
||||||
This document supersedes the earlier runtime proposal. In particular, the project will not use a system service running `dockerd` with `User=le_app_codex`, will not enable lingering, and will not install the unmodified AUR `docker-rootless-extras` package.
|
This document supersedes the earlier runtime proposal. In particular, the project will not use a system service running `dockerd` with `User=le_app_codex`, will not enable lingering, and will not install the unmodified AUR `docker-rootless-extras` package.
|
||||||
|
|
||||||
|
|
@ -42,26 +42,15 @@ Root starts and stops `user@1200.service` explicitly after inert acceptance test
|
||||||
|
|
||||||
A system unit with `User=le_app_codex` must not run `dockerd`. That model bypasses the supported per-user lifecycle and does not provide the required containment of Codex and every sibling user process.
|
A system unit with `User=le_app_codex` must not run `dockerd`. That model bypasses the supported per-user lifecycle and does not provide the required containment of Codex and every sibling user process.
|
||||||
|
|
||||||
## Package decision gate and pinned launcher
|
## Completed Phase 2A and pinned launcher
|
||||||
|
|
||||||
The last isolated preview of:
|
Phase 2A host maintenance is complete and supersedes the provisional package-maintenance gate. The host booted successfully on `7.1.3-zen1-2-zen`; both standard and Zen 7.1.3 kernels and their NVIDIA DKMS modules are installed. `rootlesskit 3.0.1-1`, `slirp4netns 1.3.4-1`, `libslirp 4.9.3-1`, and `openai-codex 0.144.1-2` are installed; `/usr/bin/codex` reports `codex-cli 0.144.1`.
|
||||||
|
|
||||||
```text
|
Post-maintenance verification also established: Laser Everything HTTP 200; NoMachine removed; stale 6.19 DKMS state removed; Snapper repaired with valid Pacman pre/post snapshots; protected Directus archive checksum valid; retired Directus stopped with restart policy `no`; `/root/server-compose-runner.sh` no longer references `lasereverything.net.forms`; and no unexpected failed system units. The retained review/evidence package is under `phase2a-host-maintenance/`.
|
||||||
pacman -Syu --needed rootlesskit slirp4netns openai-codex
|
|
||||||
```
|
|
||||||
|
|
||||||
was refreshed after removal of unused NoMachine and is now a 220-package full host upgrade (215 upgrades and 5 new packages) affecting both installed kernels and OpenSSH. It requires reboot planning, service-health checks, `.pacnew` review, explicit Snapper snapshot verification, and separate operator approval. The checksummed baseline is in `phase2a-host-maintenance/approved-transaction/`. A partial Arch upgrade is not acceptable.
|
|
||||||
|
|
||||||
The package paths are:
|
|
||||||
|
|
||||||
1. schedule and approve the complete refreshed host upgrade; or
|
|
||||||
2. investigate clean-chroot, checksum-pinned packages compatible with the current system, without partially upgrading repository packages.
|
|
||||||
|
|
||||||
The operator provisionally selected Path A on 2026-07-12 as the preferred Phase 2 package path because it is the shortest safe route consistent with Arch's complete-upgrade model. This records planning direction only: the transaction, maintenance window, package execution, and reboot remain separately approval-gated. The uncommitted review package is under `docs/le-app-database-migration/phase2a-host-maintenance/`.
|
|
||||||
|
|
||||||
Do not install the unmodified AUR `docker-rootless-extras` package. Its install hook reloads global sysctls, which exceeds this project's boundary. Do not curl an installer into a shell.
|
Do not install the unmodified AUR `docker-rootless-extras` package. Its install hook reloads global sysctls, which exceeds this project's boundary. Do not curl an installer into a shell.
|
||||||
|
|
||||||
Install only a reviewed Moby `contrib/dockerd-rootless.sh` matching the Docker engine actually installed after the chosen package path. At the current checkpoint Docker is `29.6.1`; the candidate is:
|
Install only a reviewed Moby `contrib/dockerd-rootless.sh` matching the Docker engine installed by the completed Phase 2A maintenance. Docker is `29.6.1`; the reviewed artifact is:
|
||||||
|
|
||||||
```text
|
```text
|
||||||
Moby tag: docker-v29.6.1
|
Moby tag: docker-v29.6.1
|
||||||
|
|
@ -71,7 +60,7 @@ SHA-256: 904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46
|
||||||
Owner/mode: root:root 0755
|
Owner/mode: root:root 0755
|
||||||
```
|
```
|
||||||
|
|
||||||
Revalidate the installed Docker version, upstream tag, source content, checksum, and launcher compatibility immediately before installation. If Docker changes, this filename and checksum are invalid until a matching launcher is reviewed. A clean-chroot package containing only the pinned launcher is acceptable; it must have no global sysctl hook, setup tool, service enablement, or post-install execution.
|
Docker was revalidated as Arch package `1:29.6.1-1`, client `29.6.1` build `8900f1d330`, daemon binary `29.6.1` build `8ec5ab355a`. The upstream tag, source, and checksum were re-fetched and revalidated on 2026-07-12. Revalidate all four again immediately before installation. If Docker changes, this filename and checksum are invalid until a matching launcher is reviewed. A clean-chroot package containing only the pinned launcher is acceptable; it must have no global sysctl hook, setup tool, service enablement, or post-install execution.
|
||||||
|
|
||||||
## User-manager filesystem and device containment
|
## User-manager filesystem and device containment
|
||||||
|
|
||||||
|
|
@ -132,7 +121,7 @@ ProtectControlGroups=yes
|
||||||
ProcSubset=pid
|
ProcSubset=pid
|
||||||
```
|
```
|
||||||
|
|
||||||
`ProtectProc=invisible` and hostname isolation remain acceptance-test candidates. They may be added only after the user manager, RootlessKit, Docker, Codex, and test containers pass with them. The final contract must prevent unrelated host-process inspection without breaking the supported runtime.
|
`ProtectProc=invisible` and hostname isolation remain acceptance-test candidates. Compatibility must not be assumed; they may remain only after the user manager, RootlessKit, Docker, Codex, and test containers pass with them. The final contract must prevent unrelated host-process inspection without breaking the supported runtime.
|
||||||
|
|
||||||
## Resource boundary
|
## Resource boundary
|
||||||
|
|
||||||
|
|
@ -150,7 +139,7 @@ TasksMax=4096
|
||||||
|
|
||||||
These limits cover Codex, RootlessKit, `dockerd`, containerd, builds, jobs, and all containers. Validate generated properties and cgroup delegation before relying on the limits.
|
These limits cover Codex, RootlessKit, `dockerd`, containerd, builds, jobs, and all containers. Validate generated properties and cgroup delegation before relying on the limits.
|
||||||
|
|
||||||
Disk-growth containment remains unresolved. Btrfs quotas remain intentionally disabled. The repaired `/.snapshots` Btrfs subvolume and successful Snapper snapshots 1, 2, and 3 establish snapshot operation, not quota accounting. Do not enable quotas, run `snapper setup-quota`, trigger a rescan, or impose the earlier proposed 250 GiB qgroup limit incidentally. Filesystem visibility constrains where the account may write but does not cap growth within `/srv/le-app-codex`. The operator must separately choose and approve a disk-quota policy.
|
Hard disk-growth enforcement is deferred and is not a Phase 2B installation blocker. Btrfs quotas remain intentionally disabled. The repaired `/.snapshots` Btrfs subvolume and successful Snapper snapshots 1, 2, and 3 establish snapshot operation, not quota accounting. Do not enable quotas, run `snapper setup-quota`, trigger a rescan, or impose the earlier proposed 250 GiB qgroup limit incidentally. Mandatory filesystem visibility and resource controls constrain access and CPU/memory/tasks but do not cap growth within `/srv/le-app-codex` and are not a hard storage quota.
|
||||||
|
|
||||||
Soft planning budgets remain useful for monitoring: 80 GiB container runtime, 25 GiB PostgreSQL, 15 GiB media, 10 GiB legacy uploads, 35 GiB BGBye models, 10 GiB temporary data, 5 GiB browser artifacts, 10 GiB migration reports, and 10 GiB checkout/home metadata. Startup should fail when host/project free-space thresholds are unsafe, but soft checks do not replace a hard quota.
|
Soft planning budgets remain useful for monitoring: 80 GiB container runtime, 25 GiB PostgreSQL, 15 GiB media, 10 GiB legacy uploads, 35 GiB BGBye models, 10 GiB temporary data, 5 GiB browser artifacts, 10 GiB migration reports, and 10 GiB checkout/home metadata. Startup should fail when host/project free-space thresholds are unsafe, but soft checks do not replace a hard quota.
|
||||||
|
|
||||||
|
|
@ -219,15 +208,16 @@ Docker client configuration lives only below `/srv/le-app-codex/home/.docker`. T
|
||||||
|
|
||||||
Root creates and owns the persistent namespace `/run/netns/le-app-codex`. The complete `user@1200.service` enters it through `NetworkNamespacePath`; the user cannot replace the namespace or firewall policy.
|
Root creates and owns the persistent namespace `/run/netns/le-app-codex`. The complete `user@1200.service` enters it through `NetworkNamespacePath`; the user cannot replace the namespace or firewall policy.
|
||||||
|
|
||||||
Current read-only findings at this checkpoint:
|
Current read-only findings from the checksummed root inventory:
|
||||||
|
|
||||||
- approved DNS resolver IPv4 addresses remain unresolved;
|
- the operator approved Quad9 IPv4 `9.9.9.9` and `149.112.112.112`;
|
||||||
- the host resolver currently includes `192.168.10.1`, but observation is not approval;
|
- the host resolver includes `192.168.10.1`, but it remains denied and no LAN resolver exception is proposed;
|
||||||
- no persistent `le-app-codex` network namespace currently exists;
|
- no persistent `le-app-codex` network namespace currently exists;
|
||||||
- no project-specific nftables rules are deployed;
|
- no project-specific nftables rules are deployed;
|
||||||
- the host has numerous existing Docker IPv4 and IPv6 bridge ranges.
|
- observed host public/NAT IPv4 is `74.67.173.56`, with host/LAN/WireGuard addresses `192.168.10.151`, `192.168.10.0/24`, `10.98.0.2`, and `10.98.0.0/24`;
|
||||||
|
- all 41 Docker networks and their IPv4/IPv6 IPAM ranges are retained in the Phase 2B inventory and covered by the private/IPv6 denials.
|
||||||
|
|
||||||
All host addresses, routes, LAN/VPN/WireGuard/management networks, public/NAT addresses, Docker bridges, and resolver endpoints must be dynamically inventoried immediately before drafting the final rules. Future policy must deny every observed Docker IPv4 and IPv6 bridge range and must not rely only on a stale hard-coded list.
|
All host addresses, routes, LAN/VPN/WireGuard/management networks, public/NAT addresses, Docker bridges, resolver endpoints, nftables rules, ACLs, and mounts were inventoried by root on 2026-07-12 at 20:24 EDT. The complete checksummed record is retained with the Phase 2B artifacts. The preflight dynamically repeats this inventory immediately before installation and hard-stops on drift.
|
||||||
|
|
||||||
The namespace is IPv4-only: assign no IPv6 address or route and reject IPv6 on the project veth. Do not change host-global IPv6 or sysctls.
|
The namespace is IPv4-only: assign no IPv6 address or route and reject IPv6 on the project veth. Do not change host-global IPv6 or sysctls.
|
||||||
|
|
||||||
|
|
@ -250,15 +240,13 @@ Explicitly reject:
|
||||||
- TCP 25, 465, and 587;
|
- TCP 25, 465, and 587;
|
||||||
- all IPv6 traffic.
|
- all IPv6 traffic.
|
||||||
|
|
||||||
Known addresses requiring explicit coverage include `192.168.10.151`, `10.98.0.2`, and `2603:7080:7500:1279:75aa:d64d:4cf0:8f10`; these are not a complete inventory.
|
Explicit coverage includes `192.168.10.151`, `10.98.0.2`, `74.67.173.56`, and `2603:7080:7500:1279:75aa:d64d:4cf0:8f10`, plus the inventoried network ranges. Public/NAT address drift is a fail-closed configuration-review condition before later namespace restarts or policy regeneration. Forge SSH is outside the sandbox; no TCP/22 or LAN exception is proposed.
|
||||||
|
|
||||||
Required operator inputs are approved DNS resolver IPv4 addresses, the complete host/public/NAT address set, every LAN/VPN/WireGuard/bridge/management subnet, and any approved host DNS/proxy endpoint. Do not finalize or deploy nftables without those inputs and a fresh read-only ruleset inventory. Forge SSH is outside the sandbox; no TCP/22 or LAN exception is proposed.
|
|
||||||
|
|
||||||
## Acceptance gates and order of operations
|
## Acceptance gates and order of operations
|
||||||
|
|
||||||
Every stage stops for review. No real migration data, nonproduction credentials, or Codex authentication enters the boundary until inert tests pass.
|
Every stage stops for review. No real migration data, nonproduction credentials, or Codex authentication enters the boundary until inert tests pass.
|
||||||
|
|
||||||
1. Resolve and approve the package path; install only the approved packages in a separately controlled stage.
|
1. Verify the completed Phase 2A state and do not rerun its package transaction.
|
||||||
2. If a full host upgrade was selected, reboot and complete production health verification.
|
2. If a full host upgrade was selected, reboot and complete production health verification.
|
||||||
3. Install only the version-matched, checksum-pinned Moby launcher.
|
3. Install only the version-matched, checksum-pinned Moby launcher.
|
||||||
4. Install the resource slice and user-manager containment files without starting `user@1200.service`.
|
4. Install the resource slice and user-manager containment files without starting `user@1200.service`.
|
||||||
|
|
@ -313,9 +301,6 @@ Never recursively copy or `rsync` the nonproduction workspace into production. C
|
||||||
|
|
||||||
## Unresolved decisions checklist
|
## Unresolved decisions checklist
|
||||||
|
|
||||||
- Phase 2 package path: Path A is provisionally preferred; package execution and reboot are not approved.
|
|
||||||
- Approved DNS resolver IPv4 addresses; `192.168.10.1` is currently observed but not approved.
|
|
||||||
- Complete current host, public/NAT, LAN, management, VPN, WireGuard, Docker bridge, and other container-network inventory.
|
|
||||||
- Codex authentication: device authentication or dedicated API key.
|
- Codex authentication: device authentication or dedicated API key.
|
||||||
- Disk-growth enforcement: Btrfs quota policy or another separately approved mechanism.
|
- Disk-growth enforcement: Btrfs quota policy or another separately approved mechanism.
|
||||||
- Whether deferred process/hostname hardening options pass acceptance tests.
|
- Whether deferred process/hostname hardening options pass acceptance tests.
|
||||||
|
|
|
||||||
|
|
@ -1,6 +1,6 @@
|
||||||
# Laser Everything database transition implementation plan
|
# Laser Everything database transition implementation plan
|
||||||
|
|
||||||
Status: revised pre-implementation plan. Work stops at the Milestone 0 host-runtime approval gate.
|
Status: Phase 2A complete; Phase 2B contained-runtime artifacts are review-only. Work stops at the Milestone 0 Phase 2B approval gate.
|
||||||
|
|
||||||
## Milestone 0 — complete reproducible application environment
|
## Milestone 0 — complete reproducible application environment
|
||||||
|
|
||||||
|
|
@ -10,16 +10,15 @@ Status: revised pre-implementation plan. Work stops at the Milestone 0 host-runt
|
||||||
|
|
||||||
2. **Host runtime gate — requires human approval/provisioning**
|
2. **Host runtime gate — requires human approval/provisioning**
|
||||||
- Preserve the completed inert `le_app_codex` Phase 1 identity/workspace; do not rerun bootstrap artifacts.
|
- Preserve the completed inert `le_app_codex` Phase 1 identity/workspace; do not rerun bootstrap artifacts.
|
||||||
- Preserve the provisional Path A selection: prepare a scheduled complete Arch host upgrade, but require separate approval for the final transaction and reboot; never perform a partial Arch upgrade or install the unmodified AUR extras package.
|
- Record Phase 2A host maintenance as complete and verified; its former provisional package-maintenance gate is superseded. Do not rerun it or install the unmodified AUR extras package.
|
||||||
- Use a version-matched, checksum-pinned Moby launcher and a genuine per-user Docker service managed through root-controlled `user@1200.service`; never enable lingering or run `dockerd` from a system service with `User=le_app_codex`.
|
- Use a version-matched, checksum-pinned Moby launcher and a genuine per-user Docker service managed through root-controlled `user@1200.service`; never enable lingering or run `dockerd` from a system service with `User=le_app_codex`.
|
||||||
- Apply containment and the proposed `user-1200.slice` limits to the complete user manager; accept only `unix:///run/user/1200/docker.sock`.
|
- Apply containment and the proposed `user-1200.slice` limits to the complete user manager; accept only `unix:///run/user/1200/docker.sock`.
|
||||||
- Create an IPv4-only root-owned namespace with default-deny egress and explicit host/LAN/WireGuard/metadata/private/loopback/bridge/SMTP/IPv6 denial after DNS and complete address inventories are approved.
|
- Create an IPv4-only root-owned namespace with default-deny egress and explicit host/LAN/WireGuard/metadata/private/loopback/bridge/SMTP/IPv6 denial after DNS and complete address inventories are approved.
|
||||||
- Restrict production environment files currently readable to `sol6_vi`; verify the development account cannot traverse production paths.
|
- Restrict production environment files currently readable to `sol6_vi`; verify the development account cannot traverse production paths.
|
||||||
- Use deterministic CPU BGBye initially; defer optional rootless GPU provisioning.
|
- Use deterministic CPU BGBye initially; defer optional rootless GPU provisioning.
|
||||||
- Approve browser-profile-scoped local CA trust for HTTPS testing.
|
- Approve browser-profile-scoped local CA trust for HTTPS testing.
|
||||||
- Resolve authentication and disk-quota policy separately; confirm nonproduction storage/capacity locations.
|
- Resolve authentication separately. Defer hard disk-growth enforcement without treating mandatory filesystem visibility and CPU/memory/task limits as a storage quota or Phase 2B installation blocker; confirm nonproduction storage/capacity locations.
|
||||||
- Use the refreshed post-NoMachine 220-package checksummed baseline; require exact disposition of the reviewed 234 DrKonqi desktop crash-processing failures and hard-stop on any fingerprint change or other failed unit.
|
- Preserve Phase 2A evidence: successful Zen 7.1.3 boot, dual-kernel NVIDIA DKMS, NoMachine removal, stale DKMS cleanup, repaired Snapper pre/post snapshots, protected archive verification, retired Directus disposition, runner cleanup, HTTP 200, and no unexpected failed units.
|
||||||
- Verify the repaired `/.snapshots` Btrfs subvolume and create, number, and independently verify an explicit pre-upgrade Snapper snapshot; do not enable Btrfs quotas or treat unavailable quota accounting as snapshot failure.
|
|
||||||
- Execute every inert positive and negative preflight in `host-runtime-plan.md` before starting the user manager, Docker, Codex, or application work.
|
- Execute every inert positive and negative preflight in `host-runtime-plan.md` before starting the user manager, Docker, Codex, or application work.
|
||||||
|
|
||||||
3. **Reversible canonical-path consolidation — separately approval-gated**
|
3. **Reversible canonical-path consolidation — separately approval-gated**
|
||||||
|
|
|
||||||
4
docs/le-app-database-migration/phase2b-contained-runtime/.gitattributes
vendored
Normal file
4
docs/le-app-database-migration/phase2b-contained-runtime/.gitattributes
vendored
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
# Preserve checksummed generated evidence and staged payload bytes verbatim.
|
||||||
|
inventory/** -whitespace
|
||||||
|
payload/** -whitespace
|
||||||
|
tests/** -whitespace
|
||||||
|
|
@ -0,0 +1,15 @@
|
||||||
|
# Exact staged installation and acceptance order
|
||||||
|
|
||||||
|
Every numbered boundary requires review and explicit approval. Nothing here authorizes execution.
|
||||||
|
|
||||||
|
1. From this directory, run only `tests/00-root-preinstall-validate.sh` as root and require zero failures. It atomically checks both manifests, staged nftables/systemd/shell/JSON, exact Phase 1 ownership/modes, absent approval marker/installed payload/manager/process/socket/linger, and public/NAT address drift. Save output outside production.
|
||||||
|
2. Preserve the approved Quad9 DNS pair `9.9.9.9` and `149.112.112.112`, observed public/NAT address denial `74.67.173.56`, and verified root inventory. Quad9 requires no LAN exception; `192.168.10.1` remains denied. Any different value or public/NAT drift requires artifact edits, a new manifest, and another review.
|
||||||
|
3. Copy only the manifest-listed launcher to `/usr/local/libexec`, mode `0755`, `root:root`; rehash the installed file.
|
||||||
|
4. Copy only the slice and `user@1200.service` drop-ins, resolver file, namespace helper/unit, and nftables fragment to their manifest paths with `root:root`, directories/files `0755/0644`, helper `0755`. After exact-value approval, create root-owned mode `0644` `/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED` containing the artifact-manifest checksum and approval timestamp. Do not start anything. Run `systemd-analyze verify` and `nft --check -f`; inspect the merged `systemctl cat`/properties.
|
||||||
|
5. Copy the Docker user unit/config/context and tests below `/srv/le-app-codex`; set directories `0750`, config/unit/tests `0640` except tests `0750`, all owned `1200:1200`. Do not create credentials, checkout, or source copies.
|
||||||
|
6. Run `systemctl daemon-reload`. Confirm the user manager remains inactive, lingering absent, and socket/process absent.
|
||||||
|
7. Start only `le-app-codex-netns.service`. Inspect namespace identity, IPv4-only addresses/routes, nftables counters/rules, host routing, and production Docker health. Stop on any drift.
|
||||||
|
8. Run `tests/run-inert-without-user-manager.sh`. This starts only a finite transient test process, never `user@1200.service`, Docker, or Codex. Require every filesystem/process/cgroup/device/socket/network assertion to pass.
|
||||||
|
9. Review the inert evidence. Only a later explicit runtime-acceptance approval may start `user@1200.service`, enable `docker.service` within its controlled lifetime, or run `tests/20-rootless-docker.sh` as UID 1200.
|
||||||
|
10. The later positive/negative Docker test uses only `unix:///run/user/1200/docker.sock`, disposable pinned images, and teardown. It must prove rootless/data-root/context behavior and denial of rootful sockets, private/host/LAN/VPN/metadata/SMTP/IPv6, and published ports.
|
||||||
|
11. Stop the manager after testing. Codex authentication, Codex startup, repository/source/credential copying, application startup, and production changes remain out of scope.
|
||||||
|
|
@ -0,0 +1,31 @@
|
||||||
|
f5bc35fd3767c0cbc72495b1dea283e8237789dd383ed754bf629ca09379ab97 .gitattributes
|
||||||
|
e4c381697c727f364c2a212fede2f703cfab8e0a57aaa4fa98550478a76eef55 INSTALL-ORDER.md
|
||||||
|
a62100ff7046a6e7d89adb8d2ab6bdf4ef7a72153df7cc439c8b00b42c7df347 README.md
|
||||||
|
b72075836eddd338eb1402beab775b4dc21a61d315e78cd8385f719578924293 ROLLBACK.md
|
||||||
|
b8a5f38f26fa76db6281a14de2baae3505cd78428b4c81a27a23ea89e256f321 STATIC-SAFETY-AUDIT.md
|
||||||
|
05bdf987ad0049118acf9371c6affae0d7bf65bfcb869d297986860ee20dfac4 inventory/SHA256SUMS
|
||||||
|
e6f6da94601927a23d252f32de93e92c99d31fb2d2cbd9b00f2b88224dbb684e inventory/docker-networks.json
|
||||||
|
9a5d343092c8cf473f0e4d06cb6848f1788aa8bc41b1b3fb7412faea7ea7b48c inventory/docker-networks.psv
|
||||||
|
67178aa964dfa23116984dfc5c677f8c7ef8631d5d7de989193a54a620ceaec1 inventory/host-network.txt
|
||||||
|
4695953ecd1d859198d1a5cbb6242d10ba27493ab3b1ffb3f8f77da39fd458e0 inventory/nftables-ruleset.txt
|
||||||
|
0a0db228df70f4d15e09f5c96bd0d5ac9952f4300b898266d8963225a9815988 inventory/runtime-state.txt
|
||||||
|
4d5c3252ac4f9f537ce3f69110127f13a88ea424cbc69a46ca75448341e2bae7 inventory/runtime-versions.txt
|
||||||
|
1565a8f5b5f08059ab9df69d78fed1b8190ccf674a9d368a436af63c03b804a8 inventory/workspace-acls.txt
|
||||||
|
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 inventory/workspace-mounts.txt
|
||||||
|
362b311c42fdd35bda6bcc9639403dd0f1dca17bc6469ccc9c86a9580021f046 inventory/workspace-tree.psv
|
||||||
|
1bc6ed97f33210f0d9337c7593082aaad46efdc26c86af3603f4c7c6ed88933c payload/etc/le-app-codex-runtime/resolv.conf
|
||||||
|
4289b705dbd786281daccb6d5aa660c27b83441f1a34d0cd18590666124be386 payload/etc/nftables.d/50-le-app-codex.nft
|
||||||
|
628370fd3cbb5c4572866f820fc404c23ce63505d5ac704e0b2019b3c1e72656 payload/etc/systemd/system/le-app-codex-netns.service
|
||||||
|
ea0c280203614c3e308013a8d51271bfa8adafd517f65cdf3224d2385244af6d payload/etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
|
||||||
|
30d9fdc95642ba6c9b496cc08fbfc5c9a3c8349d4c2b3331a1ff2bf4de06a383 payload/etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
|
||||||
|
44ec71cb10ef3885484a0e53a48c4cef1d028d417f4757dd7be6c95b556b92e8 payload/srv/le-app-codex/home/.config/docker/daemon.json
|
||||||
|
97aabdffb67c48379a0e5d524d8a728154cc197efa82c163608de2387b211b3b payload/srv/le-app-codex/home/.config/systemd/user/docker.service
|
||||||
|
9975f57e7cd150744f0acfe6d38c7074aa1d302465e50ca19015eedf04d6587d payload/srv/le-app-codex/home/.docker/config.json
|
||||||
|
612b81ebb800af1fe5261d1d29284136977ce278eb689d8cdee0eec2c2969cd6 payload/srv/le-app-codex/home/.docker/contexts/meta/1b645e55bd6af77d420732b143423e7a27b12fbb5a71497e5d89c52481b6a535/meta.json
|
||||||
|
904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46 payload/usr/local/libexec/dockerd-rootless-29.6.1.sh
|
||||||
|
9aed833454a78dc99af6c18da1cf09660ef717964adfd309f61f043b53c05464 payload/usr/local/libexec/le-app-codex-netns
|
||||||
|
4f94d88283207b2bfa849f4e5b126efa8872be97e59edd1f700b1b0a80623035 tests/00-read-only-preflight.sh
|
||||||
|
f7629ad1178720c6046bf73d2babdcf7f8db6398ded172c5a088340f38d077a2 tests/00-root-preinstall-validate.sh
|
||||||
|
9a573d539da46fbd683da60920596118174fdcf053f79f037ba21aee2deab82d tests/10-inert-containment.sh
|
||||||
|
0ec4d5d955e55fa8eb053fe2efa9a60509ada31afa48b71b29652dfacbf4d1c2 tests/20-rootless-docker.sh
|
||||||
|
1cf5dfa80b8d00de3ef1a47d84c30a891f4c6192345d5fc9247c4ab7d4f40f31 tests/run-inert-without-user-manager.sh
|
||||||
|
|
@ -0,0 +1,45 @@
|
||||||
|
# Phase 2B contained Codex runtime — review only
|
||||||
|
|
||||||
|
Status: complete staged review set, 2026-07-12. **Do not install or execute it.** No Phase 2B file has been copied to a host target; no namespace, nftables table, service, user manager, Docker daemon, container, Codex process, authentication, checkout, migration source, credential, or production change was created.
|
||||||
|
|
||||||
|
## Read-only verification record
|
||||||
|
|
||||||
|
- Docker was revalidated before launcher selection: package `1:29.6.1-1`; client `29.6.1` build `8900f1d330`; daemon binary `29.6.1` build `8ec5ab355a`.
|
||||||
|
- The exact Moby `docker-v29.6.1` `contrib/dockerd-rootless.sh` was fetched for review and reproduced SHA-256 `904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46`.
|
||||||
|
- Future acceptance images are pinned to OCI indexes: Alpine 3.23.3 `sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659` and nginx 1.29.4-alpine `sha256:4870c12cd2ca986de501a804b4f506ad3875a0b1874940ba0a2c7f763f1855b2`.
|
||||||
|
- The root inventory at 2026-07-12 20:24 EDT is retained verbatim under `inventory/`; every checksum in its original `SHA256SUMS` passes. Host interfaces include `192.168.10.151/24` on `enp4s0`, `10.98.0.2/24` on `wg0`, public IPv6 `2603:7080:7500:1279:75aa:d64d:4cf0:8f10/64`, loopback, and the Docker bridges below. Observed public IPv4 is `74.67.173.56`. The observed gateway/router resolver is `192.168.10.1`; it is **not approved DNS** by observation.
|
||||||
|
- `/etc/resolv.conf` also observes link-local IPv6 resolver `fe80::3e8c:f8ff:fef4:2590%enp4s0`. The proposed namespace is IPv4-only, so it is not usable there.
|
||||||
|
- Observed Docker bridge IPv4 subnets are `10.1.0.0/16`, `10.2.0.0/16`, `10.3.0.0/16`, `10.4.0.0/16`, `10.9.0.0/16`, `10.10.0.0/16`, `10.13.0.0/16`, `10.16.0.0/16` through `10.20.0.0/16`, `10.24.0.0/16`, `10.26.0.0/16` through `10.32.0.0/16`, `10.40.0.0/16`, `10.41.0.0/16`, `10.55.0.0/16`, `10.99.0.0/16`, and `172.17.0.0/16` through `172.31.0.0/16` except `172.24` is present and all ranges in that continuous interval were observed. The policy denies their covering RFC1918 ranges and the preflight re-inventories them.
|
||||||
|
- Observed Docker bridge IPv6 includes `fd00:1::/64`, `fd00:3::/64`, `fd00:4::/64`, `fd00:9::/64`, `fd00:10::/64`, `fd00:16::/64`, `fd00:17::/64`, `fd00:18::/64`, `fd00:20::/64`, `fd00:24::/64`, `fd00:26::/64` through `fd00:31::/64`, `fd00:40::/64`, `fd00:41::/64`, and link-local `fe80::/64` addresses. Namespace IPv6 is disabled and forward traffic is dropped.
|
||||||
|
- `user@1200.service` is loaded/static but inactive/dead; only the packaged `10-login-barrier.conf` drop-in exists. UID 1200 is not logged in or lingering; no UID 1200 process was observed. `/run/user/1200/docker.sock` is absent.
|
||||||
|
- `/srv/le-app-codex` is `root:le_app_codex` mode `0750`; `home`, checkout, runtime, testing, and build directories are UID/GID 1200 with mode `0700`; the source directory is root-owned `0550`; nonproduction secrets are root-owned `0750`. ACLs add no access beyond those modes. The root inventory found no project-rooted mounts.
|
||||||
|
- Root Docker inspection records 41 networks, all covered by the private/IPv6 denials. The complete nftables export has no pre-existing Phase 2B table, chain, namespace, or interface. `tests/00-read-only-preflight.sh` requires a fresh matching inventory immediately before installation.
|
||||||
|
|
||||||
|
## Artifact map
|
||||||
|
|
||||||
|
The `payload/` tree mirrors proposed absolute installation paths and makes each file separately reviewable:
|
||||||
|
|
||||||
|
- pinned Moby launcher;
|
||||||
|
- aggregate `user-1200.slice` resource drop-in;
|
||||||
|
- complete `user@1200.service` filesystem/process/device containment drop-in;
|
||||||
|
- root-owned IPv4-only namespace unit/helper;
|
||||||
|
- private read-only resolver configuration using the proposed public Quad9 IPv4 pair;
|
||||||
|
- separate default-deny nftables tables with reviewed host/network values;
|
||||||
|
- genuine rootless Docker user service;
|
||||||
|
- daemon and client context configuration accepting only `unix:///run/user/1200/docker.sock`;
|
||||||
|
- preflight, inert containment, and rootless Docker positive/negative tests;
|
||||||
|
- exact installation/acceptance order and Phase 2B-only rollback.
|
||||||
|
|
||||||
|
There are no remaining documentation sentinels. The operator approved Quad9's malware-blocking, DNSSEC-validating IPv4 pair, `9.9.9.9` and `149.112.112.112`. It requires **no LAN-address exception**; `192.168.10.1` and all of `192.168.0.0/16` remain denied. The root-created approval marker is intentionally absent because installation has not begun. Observed public/NAT IPv4 `74.67.173.56` remains explicitly denied; drift is a fail-closed configuration-review condition before later namespace restarts or policy regeneration.
|
||||||
|
|
||||||
|
## Unresolved operator inputs
|
||||||
|
|
||||||
|
1. Hard disk-growth enforcement is deferred and is not a Phase 2B installation blocker. Filesystem visibility and CPU/memory/task controls remain mandatory but are not a hard storage quota.
|
||||||
|
2. Whether `ProtectProc=invisible` passes inert and runtime acceptance without breaking rootless Docker; compatibility must not be assumed.
|
||||||
|
3. Later, separate approvals for starting the user manager/runtime and for the Codex authentication method. No Forge SSH exception, TCP Docker endpoint, rootful socket, LAN access, direct SMTP, or inbound publication is proposed.
|
||||||
|
|
||||||
|
## Validation status
|
||||||
|
|
||||||
|
The root pre-install validator passed on TITANSERVER with zero failures: both manifests, staged nftables syntax, staged systemd units/drop-ins, shell/JSON syntax, Phase 1 ownership/modes, mount absence, installed-path absence, inactive user manager, absent linger/process/socket, and unchanged public/NAT IPv4 all passed. Missing `/usr/local/libexec` warnings were expected for the uninstalled payload.
|
||||||
|
|
||||||
|
See `STATIC-SAFETY-AUDIT.md`, `INSTALL-ORDER.md`, `ROLLBACK.md`, `tests/`, `inventory/`, and `MANIFEST.sha256`. Any edit invalidates the manifest and requires another review.
|
||||||
|
|
@ -0,0 +1,12 @@
|
||||||
|
# Phase 2B-only rollback
|
||||||
|
|
||||||
|
Do not remove Phase 1 identity/workspace, Phase 2A packages, kernels, snapshots, production resources, or unrelated nftables objects.
|
||||||
|
|
||||||
|
1. Stop `user@1200.service`; confirm UID 1200 has no processes. This is the only user-manager stop in scope.
|
||||||
|
2. Stop `le-app-codex-netns.service`. Its `ExecStop` removes only `lecodex-host` and `/run/netns/le-app-codex` and deletes only the two `le_app_codex*` nftables tables.
|
||||||
|
3. Remove only the Phase 2B files enumerated in `MANIFEST.sha256` and `/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED`, preserving the pre-existing `/srv/le-app-codex` skeleton.
|
||||||
|
4. Run `systemctl daemon-reload` and `systemctl reset-failed le-app-codex-netns.service`.
|
||||||
|
5. Confirm there is no UID 1200 process, socket, namespace, veth, project nftables table, containment/resource drop-in, launcher, Docker user unit, daemon/client config, or Phase 2B test copy.
|
||||||
|
6. Confirm lingering is still disabled and production/rootful Docker remains healthy and unchanged.
|
||||||
|
|
||||||
|
If a file existed before Phase 2B, stop: this rollback package intentionally has no overwrite/restore path because installation must have failed closed on pre-existence.
|
||||||
|
|
@ -0,0 +1,17 @@
|
||||||
|
# Static safety audit
|
||||||
|
|
||||||
|
Status: pass for final review; execution remains approval-gated.
|
||||||
|
|
||||||
|
- **Endpoint:** daemon service, daemon configuration, client context, environment, and tests name only `unix:///run/user/1200/docker.sock`. No TCP, SSH, rootful, fallback, or inherited default endpoint is accepted.
|
||||||
|
- **Lifecycle:** no linger artifact or command exists. Root explicitly controls `user@1200.service`; the namespace unit cannot start until a separate operator approval marker exists.
|
||||||
|
- **Filesystem:** the complete user manager receives a private read-only `/srv` with only `/srv/le-app-codex` rebound, empty private `/var`, `/mnt`, `/media`, and `/opt`, private `/tmp`, protected homes/processes, explicit production/archive/transitional path tests, and inaccessible rootful sockets/runtime data.
|
||||||
|
- **Devices/resources:** closed device policy permits only FUSE and TUN. Aggregate CPU, memory, swap, and task limits cover the user manager and descendants. Hard disk-growth enforcement is deferred and is not a Phase 2B installation blocker; these mandatory controls are not a storage quota.
|
||||||
|
- **IPv4-only:** the namespace receives only `10.200.120.2/30`; namespace-scoped IPv6 is disabled; daemon IPv6/ip6tables are disabled; nftables drops IPv6 from the project interface.
|
||||||
|
- **Egress:** only DNS to `9.9.9.9`/`149.112.112.112` and public TCP 80/443 are accepted. Nonpublic/reserved IPv4, loopback, link-local/metadata, multicast, all RFC1918 Docker/LAN/WireGuard ranges, direct SMTP, and all other protocols/ports drop.
|
||||||
|
- **Host isolation:** host-to-project forwarding and unsolicited inbound traffic drop. Project traffic to host private addresses and observed public/NAT address `74.67.173.56` drops. RootlessKit host-loopback and external port publication are disabled and tested negatively.
|
||||||
|
- **DNS:** the operator-approved Quad9 malware-blocking, DNSSEC-validating IPv4 pair avoids any LAN exception. `/etc/resolv.conf` is rebound read-only for the user manager. The observed `192.168.10.1` router resolver remains denied.
|
||||||
|
- **Existing nftables:** the verified ruleset has no `le_app_codex` objects. Dedicated tables avoid editing Docker-owned chains. Interface-scoped terminal drops remain effective alongside existing Docker base chains.
|
||||||
|
- **Inventory:** the root record checksums pass. UID 1200 is inactive, not lingering, has no process/runtime/socket; project ACLs and modes match Phase 1; no project-rooted mounts exist; all 41 Docker networks fall within denied IPv4/IPv6 space.
|
||||||
|
- **Rollback:** names and paths are Phase 2B-specific; teardown deletes only the project tables, namespace/veth, marker, and manifest-listed files.
|
||||||
|
|
||||||
|
Hard stops remain: changed Docker version/launcher hash, changed inventory, public/NAT address drift, missing approval marker at namespace-start time, pre-existing project tables/namespace, any acceptance failure, or any endpoint other than the single rootless Unix socket. `ProtectProc=invisible` remains an unproven runtime acceptance candidate.
|
||||||
|
|
@ -0,0 +1,9 @@
|
||||||
|
e6f6da94601927a23d252f32de93e92c99d31fb2d2cbd9b00f2b88224dbb684e docker-networks.json
|
||||||
|
9a5d343092c8cf473f0e4d06cb6848f1788aa8bc41b1b3fb7412faea7ea7b48c docker-networks.psv
|
||||||
|
67178aa964dfa23116984dfc5c677f8c7ef8631d5d7de989193a54a620ceaec1 host-network.txt
|
||||||
|
4695953ecd1d859198d1a5cbb6242d10ba27493ab3b1ffb3f8f77da39fd458e0 nftables-ruleset.txt
|
||||||
|
0a0db228df70f4d15e09f5c96bd0d5ac9952f4300b898266d8963225a9815988 runtime-state.txt
|
||||||
|
4d5c3252ac4f9f537ce3f69110127f13a88ea424cbc69a46ca75448341e2bae7 runtime-versions.txt
|
||||||
|
1565a8f5b5f08059ab9df69d78fed1b8190ccf674a9d368a436af63c03b804a8 workspace-acls.txt
|
||||||
|
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 workspace-mounts.txt
|
||||||
|
362b311c42fdd35bda6bcc9639403dd0f1dca17bc6469ccc9c86a9580021f046 workspace-tree.psv
|
||||||
File diff suppressed because it is too large
Load diff
|
|
@ -0,0 +1,41 @@
|
||||||
|
5a9988b94efd|arrmail_backend|bridge|local
|
||||||
|
cfae917b997e|arrmailnetmail_clamav|bridge|local
|
||||||
|
d89dcf384c2a|arrmailnetmail_oletools|bridge|local
|
||||||
|
b7976abb6e55|arrmailnetmail_radicale|bridge|local
|
||||||
|
ecba5adea6ea|arrmailnetmail_tika|bridge|local
|
||||||
|
e02b7c89a2d3|backend_net|bridge|local
|
||||||
|
a13cb8d34076|bridge|bridge|local
|
||||||
|
051bbcfc21d8|castopod_ma_net|bridge|local
|
||||||
|
28584d053169|collabora_s6_net|bridge|local
|
||||||
|
263c8508de6f|conduit_net|bridge|local
|
||||||
|
8b881e367322|directus_net|bridge|local
|
||||||
|
87e08370adff|forge_net|bridge|local
|
||||||
|
bca9ecea74f1|heimdall_s6_net|bridge|local
|
||||||
|
d905d3d625d9|host|host|local
|
||||||
|
4ecbee63f4b0|immich_s6_net|bridge|local
|
||||||
|
527a7cd84ff6|irc_net|bridge|local
|
||||||
|
8200b83f03e9|jellyfin_s6_net|bridge|local
|
||||||
|
6caddd639b0b|lasereverythingnetmanager_default|bridge|local
|
||||||
|
875fced92cd0|lasereverythingnettv_default|bridge|local
|
||||||
|
03ee8c9e4bea|lemmy_net|bridge|local
|
||||||
|
68e2ed0ec6ac|mailu_net|bridge|local
|
||||||
|
11ceaf8736f5|makearmy_net|bridge|local
|
||||||
|
2d50ca7a8f5d|makearmyiocast_default|bridge|local
|
||||||
|
eeee48934935|makearmyiodcm_default|bridge|local
|
||||||
|
dee363d4e0c6|makearmyiovdo_default|bridge|local
|
||||||
|
4efe811b8402|makearmyiowatch_peertube_net|bridge|local
|
||||||
|
f3f5c7cfa74e|mastodon_net|bridge|local
|
||||||
|
fea0382ed10b|meet_net|bridge|local
|
||||||
|
f10b040acc46|misskey_net|bridge|local
|
||||||
|
618855db6757|navidrome_s6_net|bridge|local
|
||||||
|
dc41f9983a47|nextcloud_ma_net|bridge|local
|
||||||
|
57b7955ca01d|none|null|local
|
||||||
|
ed1bb1cc9d39|picsur_net|bridge|local
|
||||||
|
59ca07fbf200|pixelfed_ma_net|bridge|local
|
||||||
|
f9343d8383ac|privatebin_rw_net|bridge|local
|
||||||
|
71bcae37092b|s6vinetgames_default|bridge|local
|
||||||
|
c50ccbc5e464|s6vinetmedia_media_s6_net|bridge|local
|
||||||
|
9891a93b5e9c|s6vinetyt_default|bridge|local
|
||||||
|
9aea00f5a485|snappy_net|bridge|local
|
||||||
|
f63e542ab28c|vault_net|bridge|local
|
||||||
|
a35cbfd37253|yacht_s6_net|bridge|local
|
||||||
|
|
@ -0,0 +1,885 @@
|
||||||
|
=== IPv4/IPv6 addresses ===
|
||||||
|
lo UNKNOWN 127.0.0.1/8 ::1/128
|
||||||
|
enp4s0 UP 192.168.10.151/24 2603:7080:7500:1279:75aa:d64d:4cf0:8f10/64 fe80::e6f:317c:ee82:e5e/64
|
||||||
|
wlo1 DOWN
|
||||||
|
wg0 UNKNOWN 10.98.0.2/24
|
||||||
|
br-11ceaf8736f5 UP 10.55.0.1/16 fe80::a065:eaff:fef3:532d/64
|
||||||
|
br-dee363d4e0c6 DOWN 172.29.0.1/16 fe80::b86e:58ff:fef5:85f6/64
|
||||||
|
docker0 UP 172.17.0.1/16 fe80::48e9:9ff:fea5:2c72/64
|
||||||
|
br-5a9988b94efd UP 10.1.0.1/16 fd00:1::1/64 fe80::a843:f3ff:fedb:ef64/64
|
||||||
|
br-e02b7c89a2d3 UP 10.99.0.1/16 fe80::2c30:58ff:fe89:f9d2/64
|
||||||
|
br-875fced92cd0 DOWN 172.25.0.1/16 fe80::6c7e:7fff:fe2a:bf1d/64
|
||||||
|
vethf79d976@if2 UP fe80::4c52:c7ff:fe49:3b0e/64
|
||||||
|
veth605aea1@if2 UP fe80::ec3f:78ff:fe38:75b9/64
|
||||||
|
vethf583175@if2 UP fe80::f0c3:fff:fe8b:74e3/64
|
||||||
|
vethca028f8@if2 UP fe80::ccd1:f1ff:fe0f:c699/64
|
||||||
|
veth880eb86@if2 UP fe80::548d:f8ff:fef4:c0db/64
|
||||||
|
veth7e2863d@if2 UP fe80::ac5e:9cff:fe45:ec06/64
|
||||||
|
veth55cb2ec@if2 UP fe80::28b8:bdff:fe81:370f/64
|
||||||
|
br-9aea00f5a485 UP 10.3.0.1/16 fd00:3::1/64 fe80::68b1:bff:fee2:9d17/64
|
||||||
|
vethee5b2b0@if2 UP fe80::6486:bfff:fee7:22df/64
|
||||||
|
br-68e2ed0ec6ac UP 10.2.0.1/16 fe80::1058:f8ff:fe69:21bb/64
|
||||||
|
br-b7976abb6e55 UP 172.18.0.1/16 fe80::a8fe:4ff:fe1f:d81a/64
|
||||||
|
br-ecba5adea6ea UP 172.19.0.1/16 fe80::f8d4:eff:fe6e:19a9/64
|
||||||
|
br-cfae917b997e UP 172.20.0.1/16 fe80::60fc:94ff:fe7d:a58f/64
|
||||||
|
br-d89dcf384c2a UP 172.21.0.1/16 fe80::b471:19ff:fe52:ff1/64
|
||||||
|
vethbe8f01c@if2 UP fe80::63:73ff:fede:43f9/64
|
||||||
|
veth38ae454@if2 UP fe80::f01a:4eff:fef2:9942/64
|
||||||
|
veth2edd7d6@if2 UP fe80::3c0c:90ff:fe10:332f/64
|
||||||
|
veth563d3b9@if2 UP fe80::d037:e3ff:fe79:1a5f/64
|
||||||
|
veth766794b@if2 UP fe80::3441:76ff:fe3f:f8d1/64
|
||||||
|
veth426f4c7@if2 UP fe80::74c2:12ff:fe72:7875/64
|
||||||
|
veth362d4c6@if2 UP fe80::f038:dbff:fefd:87d3/64
|
||||||
|
veth4ecfbb5@if2 UP fe80::d847:aaff:fe89:3f9/64
|
||||||
|
veth2d01312@if3 UP fe80::5455:fbff:fec6:391e/64
|
||||||
|
veth99bb318@if2 UP fe80::4a3:bbff:fea9:df98/64
|
||||||
|
vethcae9493@if2 UP fe80::2844:4dff:fec7:1613/64
|
||||||
|
veth8c83268@if2 UP fe80::8832:52ff:fee4:8a93/64
|
||||||
|
veth6f6f074@if3 UP fe80::ac67:76ff:fe15:1676/64
|
||||||
|
veth4216565@if3 UP fe80::4463:6dff:fe29:79d5/64
|
||||||
|
veth46248ff@if4 UP fe80::18c7:26ff:fe8b:bea4/64
|
||||||
|
vethc0ef06c@if2 UP fe80::5852:d0ff:fe9e:545/64
|
||||||
|
br-f63e542ab28c UP 10.4.0.1/16 fd00:4::1/64 fe80::28df:aff:fe50:a6d2/64
|
||||||
|
vethaeee758@if2 UP fe80::e807:c7ff:fee0:f12d/64
|
||||||
|
br-8b881e367322 DOWN 10.40.0.1/16 fd00:40::1/64 fe80::c030:54ff:fe2d:eb36/64
|
||||||
|
br-6caddd639b0b UP 172.22.0.1/16 fe80::c0da:5bff:fea4:92dc/64
|
||||||
|
veth2906c94@if2 UP fe80::1c13:3ff:fe18:c9a4/64
|
||||||
|
br-2d50ca7a8f5d UP 172.23.0.1/16 fe80::548d:1eff:fe36:12c5/64
|
||||||
|
vethbb40f36@if2 UP fe80::c000:96ff:fe7d:11a8/64
|
||||||
|
br-dc41f9983a47 UP 10.30.0.1/16 fd00:30::1/64 fe80::78cf:3dff:fe72:528b/64
|
||||||
|
veth6594ba0@if2 UP fe80::9091:4aff:feee:8942/64
|
||||||
|
veth28958e3@if2 UP fe80::d037:82ff:fee7:27c5/64
|
||||||
|
veth1f2dc82@if3 UP fe80::e49e:23ff:feb7:932d/64
|
||||||
|
veth04a7fbe@if4 UP fe80::e488:ccff:fe2f:e545/64
|
||||||
|
veth2273529@if2 UP fe80::869:a1ff:fee9:63a6/64
|
||||||
|
br-eeee48934935 UP 172.24.0.1/16 fe80::ac86:86ff:fe64:f2d4/64
|
||||||
|
veth160d05f@if2 UP fe80::50f3:d6ff:fedd:1cd3/64
|
||||||
|
br-f10b040acc46 UP 10.29.0.1/16 fd00:29::1/64 fe80::4c63:fcff:fe4c:7d6a/64
|
||||||
|
vethd88eb9b@if2 UP fe80::a4a0:13ff:fe7f:7c8d/64
|
||||||
|
veth80da983@if2 UP fe80::a0eb:3bff:fe66:df68/64
|
||||||
|
veth2bde217@if3 UP fe80::24de:7fff:fef9:e7af/64
|
||||||
|
br-87e08370adff UP 10.27.0.1/16 fd00:27::1/64 fe80::40f5:bfff:fed7:8296/64
|
||||||
|
veth9e2bcbb@if2 UP fe80::5030:beff:fead:c50a/64
|
||||||
|
veth0477205@if3 UP fe80::48ec:7cff:fe17:27bc/64
|
||||||
|
br-ed1bb1cc9d39 UP 10.28.0.1/16 fd00:28::1/64 fe80::30d4:6bff:fe54:5fb3/64
|
||||||
|
veth370f490@if2 UP fe80::c090:5eff:fed8:d1cc/64
|
||||||
|
vethca0ee65@if2 UP fe80::c1f:b5ff:fe0a:c936/64
|
||||||
|
veth4692f5c@if3 UP fe80::2c60:58ff:fe86:30d3/64
|
||||||
|
br-527a7cd84ff6 UP 10.20.0.1/16 fd00:20::1/64 fe80::4482:41ff:feb3:9c74/64
|
||||||
|
vethd14eb7e@if2 UP fe80::84bf:b2ff:fec4:ea7/64
|
||||||
|
br-03ee8c9e4bea UP 172.28.0.1/16 fe80::f01f:e5ff:fe2b:ec80/64
|
||||||
|
veth3c1861e@if2 UP fe80::1c6e:c5ff:fe94:c515/64
|
||||||
|
veth32d5964@if2 UP fe80::80a3:1eff:fe61:4f10/64
|
||||||
|
vetha548a1a@if3 UP fe80::3c6e:51ff:fe48:e037/64
|
||||||
|
veth762d601@if2 UP fe80::424:9bff:fe91:317e/64
|
||||||
|
vethf48aa55@if2 UP fe80::805a:47ff:fe53:cfcd/64
|
||||||
|
br-f3f5c7cfa74e UP 10.31.0.1/16 fd00:31::1/64 fe80::f4a6:b6ff:fe24:af71/64
|
||||||
|
vethf5f3d34@if2 UP fe80::c006:5ff:fea6:b743/64
|
||||||
|
veth335556c@if2 UP fe80::90ed:30ff:fe51:2b5a/64
|
||||||
|
veth9cc2ad8@if2 UP fe80::6c50:96ff:fe29:70a6/64
|
||||||
|
veth6232cb7@if2 UP fe80::64fe:2aff:fed1:1e41/64
|
||||||
|
veth337e2fd@if2 UP fe80::f0bf:5ff:fee7:2b1e/64
|
||||||
|
veth7d6d658@if3 UP fe80::80fb:8fff:fead:2208/64
|
||||||
|
veth448a204@if3 UP fe80::90ff:b0ff:fe58:21fb/64
|
||||||
|
veth79ea708@if3 UP fe80::ac43:75ff:fefa:cbfd/64
|
||||||
|
br-263c8508de6f UP 10.26.0.1/16 fd00:26::1/64 fe80::d8c8:aaff:fe63:6af9/64
|
||||||
|
veth4ba8ed1@if2 UP fe80::2095:66ff:fe78:518e/64
|
||||||
|
br-fea0382ed10b UP 172.26.0.1/16 fe80::6c9c:c1ff:fe95:888e/64
|
||||||
|
veth4a87e58@if2 UP fe80::c899:1fff:fe27:7f66/64
|
||||||
|
vethacfaa19@if2 UP fe80::90ed:f4ff:feed:a749/64
|
||||||
|
veth30db54a@if2 UP fe80::e855:acff:fef2:5aa3/64
|
||||||
|
vethe969d14@if2 UP fe80::303f:6ff:fe24:1fa6/64
|
||||||
|
veth0e4600c@if2 UP fe80::b441:acff:fe66:5981/64
|
||||||
|
br-f9343d8383ac UP 10.24.0.1/16 fd00:24::1/64 fe80::c8b0:56ff:fe7e:bc48/64
|
||||||
|
veth21e2097@if2 UP fe80::b48b:1aff:fe71:36d3/64
|
||||||
|
br-59ca07fbf200 UP 10.32.0.1/16 fe80::fc79:ccff:fefd:20d7/64
|
||||||
|
veth58179de@if2 UP fe80::6cb5:cff:fea2:a675/64
|
||||||
|
veth6b9d50d@if2 UP fe80::d45e:64ff:fe90:37e7/64
|
||||||
|
veth2445f8e@if2 UP fe80::cc80:50ff:feb5:67b/64
|
||||||
|
veth368657c@if3 UP fe80::a065:bfff:fea5:34/64
|
||||||
|
veth5f6906b@if3 UP fe80::502a:e5ff:fe5c:d5fa/64
|
||||||
|
veth2dd045f@if4 UP fe80::464:d7ff:fea1:a54a/64
|
||||||
|
veth53fd806@if4 UP fe80::7cdd:44ff:fe90:1f77/64
|
||||||
|
br-051bbcfc21d8 UP 10.41.0.1/16 fd00:41::1/64 fe80::d457:2bff:fe72:23f/64
|
||||||
|
veth2b9371a@if2 UP fe80::d44c:3bff:fe3b:934f/64
|
||||||
|
veth165b4aa@if2 UP fe80::c85e:5aff:feaa:f812/64
|
||||||
|
veth8c376e6@if3 UP fe80::542a:61ff:fe38:307c/64
|
||||||
|
veth73c775b@if4 UP fe80::7462:7dff:fe8f:115d/64
|
||||||
|
br-4efe811b8402 UP 172.27.0.1/16 fe80::d87e:fbff:fec6:5aeb/64
|
||||||
|
veth56166e3@if2 UP fe80::dc0f:5dff:fec4:7c53/64
|
||||||
|
veth14193e1@if2 UP fe80::aca7:68ff:fe42:e77/64
|
||||||
|
vethe9fcee3@if3 UP fe80::443:71ff:feac:bdfb/64
|
||||||
|
br-bca9ecea74f1 UP 10.10.0.1/16 fd00:10::1/64 fe80::4421:95ff:fe94:d7c5/64
|
||||||
|
veth71028db@if2 UP fe80::a4ab:b9ff:fe3e:af94/64
|
||||||
|
br-a35cbfd37253 UP 10.13.0.1/16 fe80::aca7:12ff:fe18:d1b9/64
|
||||||
|
vethe123758@if2 UP fe80::44ee:8eff:fe1a:bcf4/64
|
||||||
|
br-71bcae37092b UP 172.30.0.1/16 fe80::286c:a2ff:fe49:5772/64
|
||||||
|
veth8d698e0@if2 UP fe80::d86b:4fff:fec2:50e0/64
|
||||||
|
vethd87ba34@if2 UP fe80::e87f:edff:fe10:e8d6/64
|
||||||
|
br-c50ccbc5e464 UP 10.19.0.1/16 fe80::9879:f6ff:fe6d:57be/64
|
||||||
|
veth1bece5c@if2 UP fe80::30f1:2cff:feac:90cb/64
|
||||||
|
veth6091231@if2 UP fe80::d44d:feff:fe18:d291/64
|
||||||
|
veth502e53b@if2 UP fe80::a047:6eff:fe8b:1f48/64
|
||||||
|
br-618855db6757 UP 10.16.0.1/16 fd00:16::1/64 fe80::aca8:14ff:feee:df7c/64
|
||||||
|
vethe6c6432@if2 UP fe80::e447:bff:feea:1f61/64
|
||||||
|
veth1f1f066@if3 UP fe80::90da:e3ff:fefa:7464/64
|
||||||
|
veth26a5545@if4 UP fe80::888d:45ff:feeb:4a48/64
|
||||||
|
br-28584d053169 UP 10.17.0.1/16 fd00:17::1/64 fe80::7c73:c8ff:fe04:3dd2/64
|
||||||
|
vethe488043@if2 UP fe80::7069:c0ff:febd:1d88/64
|
||||||
|
br-4ecbee63f4b0 UP 10.18.0.1/16 fd00:18::1/64 fe80::e46c:23ff:fec3:3ab9/64
|
||||||
|
veth15eb212@if2 UP fe80::5c80:75ff:feff:22dd/64
|
||||||
|
veth551b749@if2 UP fe80::7c42:75ff:fe80:5953/64
|
||||||
|
veth41b1943@if2 UP fe80::bc01:62ff:fe13:b616/64
|
||||||
|
vethc2b3531@if3 UP fe80::b4d5:57ff:fe87:83f9/64
|
||||||
|
br-8200b83f03e9 UP 10.9.0.1/16 fd00:9::1/64 fe80::4c80:8fff:feec:15d4/64
|
||||||
|
veth62aa43d@if2 UP fe80::acc5:57ff:fece:3b51/64
|
||||||
|
br-9891a93b5e9c UP 172.31.0.1/16 fe80::e0a6:32ff:fe63:9f8d/64
|
||||||
|
veth081c8bf@if2 UP fe80::3c1f:f9ff:fe36:4122/64
|
||||||
|
|
||||||
|
=== IPv4 routes ===
|
||||||
|
default via 10.98.0.1 dev wg0 table wg0
|
||||||
|
default via 192.168.10.1 dev enp4s0 proto dhcp src 192.168.10.151 metric 100
|
||||||
|
10.1.0.0/16 dev br-5a9988b94efd proto kernel scope link src 10.1.0.1
|
||||||
|
10.2.0.0/16 dev br-68e2ed0ec6ac proto kernel scope link src 10.2.0.1
|
||||||
|
10.3.0.0/16 dev br-9aea00f5a485 proto kernel scope link src 10.3.0.1
|
||||||
|
10.4.0.0/16 dev br-f63e542ab28c proto kernel scope link src 10.4.0.1
|
||||||
|
10.9.0.0/16 dev br-8200b83f03e9 proto kernel scope link src 10.9.0.1
|
||||||
|
10.10.0.0/16 dev br-bca9ecea74f1 proto kernel scope link src 10.10.0.1
|
||||||
|
10.13.0.0/16 dev br-a35cbfd37253 proto kernel scope link src 10.13.0.1
|
||||||
|
10.16.0.0/16 dev br-618855db6757 proto kernel scope link src 10.16.0.1
|
||||||
|
10.17.0.0/16 dev br-28584d053169 proto kernel scope link src 10.17.0.1
|
||||||
|
10.18.0.0/16 dev br-4ecbee63f4b0 proto kernel scope link src 10.18.0.1
|
||||||
|
10.19.0.0/16 dev br-c50ccbc5e464 proto kernel scope link src 10.19.0.1
|
||||||
|
10.20.0.0/16 dev br-527a7cd84ff6 proto kernel scope link src 10.20.0.1
|
||||||
|
10.24.0.0/16 dev br-f9343d8383ac proto kernel scope link src 10.24.0.1
|
||||||
|
10.26.0.0/16 dev br-263c8508de6f proto kernel scope link src 10.26.0.1
|
||||||
|
10.27.0.0/16 dev br-87e08370adff proto kernel scope link src 10.27.0.1
|
||||||
|
10.28.0.0/16 dev br-ed1bb1cc9d39 proto kernel scope link src 10.28.0.1
|
||||||
|
10.29.0.0/16 dev br-f10b040acc46 proto kernel scope link src 10.29.0.1
|
||||||
|
10.30.0.0/16 dev br-dc41f9983a47 proto kernel scope link src 10.30.0.1
|
||||||
|
10.31.0.0/16 dev br-f3f5c7cfa74e proto kernel scope link src 10.31.0.1
|
||||||
|
10.32.0.0/16 dev br-59ca07fbf200 proto kernel scope link src 10.32.0.1
|
||||||
|
10.40.0.0/16 dev br-8b881e367322 proto kernel scope link src 10.40.0.1 linkdown
|
||||||
|
10.41.0.0/16 dev br-051bbcfc21d8 proto kernel scope link src 10.41.0.1
|
||||||
|
10.55.0.0/16 dev br-11ceaf8736f5 proto kernel scope link src 10.55.0.1
|
||||||
|
10.98.0.0/24 dev wg0 proto kernel scope link src 10.98.0.2
|
||||||
|
10.99.0.0/16 dev br-e02b7c89a2d3 proto kernel scope link src 10.99.0.1
|
||||||
|
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
|
||||||
|
172.18.0.0/16 dev br-b7976abb6e55 proto kernel scope link src 172.18.0.1
|
||||||
|
172.19.0.0/16 dev br-ecba5adea6ea proto kernel scope link src 172.19.0.1
|
||||||
|
172.20.0.0/16 dev br-cfae917b997e proto kernel scope link src 172.20.0.1
|
||||||
|
172.21.0.0/16 dev br-d89dcf384c2a proto kernel scope link src 172.21.0.1
|
||||||
|
172.22.0.0/16 dev br-6caddd639b0b proto kernel scope link src 172.22.0.1
|
||||||
|
172.23.0.0/16 dev br-2d50ca7a8f5d proto kernel scope link src 172.23.0.1
|
||||||
|
172.24.0.0/16 dev br-eeee48934935 proto kernel scope link src 172.24.0.1
|
||||||
|
172.25.0.0/16 dev br-875fced92cd0 proto kernel scope link src 172.25.0.1 linkdown
|
||||||
|
172.26.0.0/16 dev br-fea0382ed10b proto kernel scope link src 172.26.0.1
|
||||||
|
172.27.0.0/16 dev br-4efe811b8402 proto kernel scope link src 172.27.0.1
|
||||||
|
172.28.0.0/16 dev br-03ee8c9e4bea proto kernel scope link src 172.28.0.1
|
||||||
|
172.29.0.0/16 dev br-dee363d4e0c6 proto kernel scope link src 172.29.0.1 linkdown
|
||||||
|
172.30.0.0/16 dev br-71bcae37092b proto kernel scope link src 172.30.0.1
|
||||||
|
172.31.0.0/16 dev br-9891a93b5e9c proto kernel scope link src 172.31.0.1
|
||||||
|
192.168.10.0/24 dev enp4s0 proto kernel scope link src 192.168.10.151 metric 100
|
||||||
|
local 10.1.0.1 dev br-5a9988b94efd table local proto kernel scope host src 10.1.0.1
|
||||||
|
broadcast 10.1.255.255 dev br-5a9988b94efd table local proto kernel scope link src 10.1.0.1
|
||||||
|
local 10.2.0.1 dev br-68e2ed0ec6ac table local proto kernel scope host src 10.2.0.1
|
||||||
|
broadcast 10.2.255.255 dev br-68e2ed0ec6ac table local proto kernel scope link src 10.2.0.1
|
||||||
|
local 10.3.0.1 dev br-9aea00f5a485 table local proto kernel scope host src 10.3.0.1
|
||||||
|
broadcast 10.3.255.255 dev br-9aea00f5a485 table local proto kernel scope link src 10.3.0.1
|
||||||
|
local 10.4.0.1 dev br-f63e542ab28c table local proto kernel scope host src 10.4.0.1
|
||||||
|
broadcast 10.4.255.255 dev br-f63e542ab28c table local proto kernel scope link src 10.4.0.1
|
||||||
|
local 10.9.0.1 dev br-8200b83f03e9 table local proto kernel scope host src 10.9.0.1
|
||||||
|
broadcast 10.9.255.255 dev br-8200b83f03e9 table local proto kernel scope link src 10.9.0.1
|
||||||
|
local 10.10.0.1 dev br-bca9ecea74f1 table local proto kernel scope host src 10.10.0.1
|
||||||
|
broadcast 10.10.255.255 dev br-bca9ecea74f1 table local proto kernel scope link src 10.10.0.1
|
||||||
|
local 10.13.0.1 dev br-a35cbfd37253 table local proto kernel scope host src 10.13.0.1
|
||||||
|
broadcast 10.13.255.255 dev br-a35cbfd37253 table local proto kernel scope link src 10.13.0.1
|
||||||
|
local 10.16.0.1 dev br-618855db6757 table local proto kernel scope host src 10.16.0.1
|
||||||
|
broadcast 10.16.255.255 dev br-618855db6757 table local proto kernel scope link src 10.16.0.1
|
||||||
|
local 10.17.0.1 dev br-28584d053169 table local proto kernel scope host src 10.17.0.1
|
||||||
|
broadcast 10.17.255.255 dev br-28584d053169 table local proto kernel scope link src 10.17.0.1
|
||||||
|
local 10.18.0.1 dev br-4ecbee63f4b0 table local proto kernel scope host src 10.18.0.1
|
||||||
|
broadcast 10.18.255.255 dev br-4ecbee63f4b0 table local proto kernel scope link src 10.18.0.1
|
||||||
|
local 10.19.0.1 dev br-c50ccbc5e464 table local proto kernel scope host src 10.19.0.1
|
||||||
|
broadcast 10.19.255.255 dev br-c50ccbc5e464 table local proto kernel scope link src 10.19.0.1
|
||||||
|
local 10.20.0.1 dev br-527a7cd84ff6 table local proto kernel scope host src 10.20.0.1
|
||||||
|
broadcast 10.20.255.255 dev br-527a7cd84ff6 table local proto kernel scope link src 10.20.0.1
|
||||||
|
local 10.24.0.1 dev br-f9343d8383ac table local proto kernel scope host src 10.24.0.1
|
||||||
|
broadcast 10.24.255.255 dev br-f9343d8383ac table local proto kernel scope link src 10.24.0.1
|
||||||
|
local 10.26.0.1 dev br-263c8508de6f table local proto kernel scope host src 10.26.0.1
|
||||||
|
broadcast 10.26.255.255 dev br-263c8508de6f table local proto kernel scope link src 10.26.0.1
|
||||||
|
local 10.27.0.1 dev br-87e08370adff table local proto kernel scope host src 10.27.0.1
|
||||||
|
broadcast 10.27.255.255 dev br-87e08370adff table local proto kernel scope link src 10.27.0.1
|
||||||
|
local 10.28.0.1 dev br-ed1bb1cc9d39 table local proto kernel scope host src 10.28.0.1
|
||||||
|
broadcast 10.28.255.255 dev br-ed1bb1cc9d39 table local proto kernel scope link src 10.28.0.1
|
||||||
|
local 10.29.0.1 dev br-f10b040acc46 table local proto kernel scope host src 10.29.0.1
|
||||||
|
broadcast 10.29.255.255 dev br-f10b040acc46 table local proto kernel scope link src 10.29.0.1
|
||||||
|
local 10.30.0.1 dev br-dc41f9983a47 table local proto kernel scope host src 10.30.0.1
|
||||||
|
broadcast 10.30.255.255 dev br-dc41f9983a47 table local proto kernel scope link src 10.30.0.1
|
||||||
|
local 10.31.0.1 dev br-f3f5c7cfa74e table local proto kernel scope host src 10.31.0.1
|
||||||
|
broadcast 10.31.255.255 dev br-f3f5c7cfa74e table local proto kernel scope link src 10.31.0.1
|
||||||
|
local 10.32.0.1 dev br-59ca07fbf200 table local proto kernel scope host src 10.32.0.1
|
||||||
|
broadcast 10.32.255.255 dev br-59ca07fbf200 table local proto kernel scope link src 10.32.0.1
|
||||||
|
local 10.40.0.1 dev br-8b881e367322 table local proto kernel scope host src 10.40.0.1
|
||||||
|
broadcast 10.40.255.255 dev br-8b881e367322 table local proto kernel scope link src 10.40.0.1 linkdown
|
||||||
|
local 10.41.0.1 dev br-051bbcfc21d8 table local proto kernel scope host src 10.41.0.1
|
||||||
|
broadcast 10.41.255.255 dev br-051bbcfc21d8 table local proto kernel scope link src 10.41.0.1
|
||||||
|
local 10.55.0.1 dev br-11ceaf8736f5 table local proto kernel scope host src 10.55.0.1
|
||||||
|
broadcast 10.55.255.255 dev br-11ceaf8736f5 table local proto kernel scope link src 10.55.0.1
|
||||||
|
local 10.98.0.2 dev wg0 table local proto kernel scope host src 10.98.0.2
|
||||||
|
broadcast 10.98.0.255 dev wg0 table local proto kernel scope link src 10.98.0.2
|
||||||
|
local 10.99.0.1 dev br-e02b7c89a2d3 table local proto kernel scope host src 10.99.0.1
|
||||||
|
broadcast 10.99.255.255 dev br-e02b7c89a2d3 table local proto kernel scope link src 10.99.0.1
|
||||||
|
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
|
||||||
|
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
|
||||||
|
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
|
||||||
|
local 172.17.0.1 dev docker0 table local proto kernel scope host src 172.17.0.1
|
||||||
|
broadcast 172.17.255.255 dev docker0 table local proto kernel scope link src 172.17.0.1
|
||||||
|
local 172.18.0.1 dev br-b7976abb6e55 table local proto kernel scope host src 172.18.0.1
|
||||||
|
broadcast 172.18.255.255 dev br-b7976abb6e55 table local proto kernel scope link src 172.18.0.1
|
||||||
|
local 172.19.0.1 dev br-ecba5adea6ea table local proto kernel scope host src 172.19.0.1
|
||||||
|
broadcast 172.19.255.255 dev br-ecba5adea6ea table local proto kernel scope link src 172.19.0.1
|
||||||
|
local 172.20.0.1 dev br-cfae917b997e table local proto kernel scope host src 172.20.0.1
|
||||||
|
broadcast 172.20.255.255 dev br-cfae917b997e table local proto kernel scope link src 172.20.0.1
|
||||||
|
local 172.21.0.1 dev br-d89dcf384c2a table local proto kernel scope host src 172.21.0.1
|
||||||
|
broadcast 172.21.255.255 dev br-d89dcf384c2a table local proto kernel scope link src 172.21.0.1
|
||||||
|
local 172.22.0.1 dev br-6caddd639b0b table local proto kernel scope host src 172.22.0.1
|
||||||
|
broadcast 172.22.255.255 dev br-6caddd639b0b table local proto kernel scope link src 172.22.0.1
|
||||||
|
local 172.23.0.1 dev br-2d50ca7a8f5d table local proto kernel scope host src 172.23.0.1
|
||||||
|
broadcast 172.23.255.255 dev br-2d50ca7a8f5d table local proto kernel scope link src 172.23.0.1
|
||||||
|
local 172.24.0.1 dev br-eeee48934935 table local proto kernel scope host src 172.24.0.1
|
||||||
|
broadcast 172.24.255.255 dev br-eeee48934935 table local proto kernel scope link src 172.24.0.1
|
||||||
|
local 172.25.0.1 dev br-875fced92cd0 table local proto kernel scope host src 172.25.0.1
|
||||||
|
broadcast 172.25.255.255 dev br-875fced92cd0 table local proto kernel scope link src 172.25.0.1 linkdown
|
||||||
|
local 172.26.0.1 dev br-fea0382ed10b table local proto kernel scope host src 172.26.0.1
|
||||||
|
broadcast 172.26.255.255 dev br-fea0382ed10b table local proto kernel scope link src 172.26.0.1
|
||||||
|
local 172.27.0.1 dev br-4efe811b8402 table local proto kernel scope host src 172.27.0.1
|
||||||
|
broadcast 172.27.255.255 dev br-4efe811b8402 table local proto kernel scope link src 172.27.0.1
|
||||||
|
local 172.28.0.1 dev br-03ee8c9e4bea table local proto kernel scope host src 172.28.0.1
|
||||||
|
broadcast 172.28.255.255 dev br-03ee8c9e4bea table local proto kernel scope link src 172.28.0.1
|
||||||
|
local 172.29.0.1 dev br-dee363d4e0c6 table local proto kernel scope host src 172.29.0.1
|
||||||
|
broadcast 172.29.255.255 dev br-dee363d4e0c6 table local proto kernel scope link src 172.29.0.1 linkdown
|
||||||
|
local 172.30.0.1 dev br-71bcae37092b table local proto kernel scope host src 172.30.0.1
|
||||||
|
broadcast 172.30.255.255 dev br-71bcae37092b table local proto kernel scope link src 172.30.0.1
|
||||||
|
local 172.31.0.1 dev br-9891a93b5e9c table local proto kernel scope host src 172.31.0.1
|
||||||
|
broadcast 172.31.255.255 dev br-9891a93b5e9c table local proto kernel scope link src 172.31.0.1
|
||||||
|
local 192.168.10.151 dev enp4s0 table local proto kernel scope host src 192.168.10.151
|
||||||
|
broadcast 192.168.10.255 dev enp4s0 table local proto kernel scope link src 192.168.10.151
|
||||||
|
|
||||||
|
=== IPv6 routes ===
|
||||||
|
2603:7080:7500:1279::/64 dev enp4s0 proto ra metric 100 pref medium
|
||||||
|
fd00:1::/64 dev br-5a9988b94efd proto kernel metric 256 pref medium
|
||||||
|
fd00:3::/64 dev br-9aea00f5a485 proto kernel metric 256 pref medium
|
||||||
|
fd00:4::/64 dev br-f63e542ab28c proto kernel metric 256 pref medium
|
||||||
|
fd00:9::/64 dev br-8200b83f03e9 proto kernel metric 256 pref medium
|
||||||
|
fd00:10::/64 dev br-bca9ecea74f1 proto kernel metric 256 pref medium
|
||||||
|
fd00:16::/64 dev br-618855db6757 proto kernel metric 256 pref medium
|
||||||
|
fd00:17::/64 dev br-28584d053169 proto kernel metric 256 pref medium
|
||||||
|
fd00:18::/64 dev br-4ecbee63f4b0 proto kernel metric 256 pref medium
|
||||||
|
fd00:20::/64 dev br-527a7cd84ff6 proto kernel metric 256 pref medium
|
||||||
|
fd00:24::/64 dev br-f9343d8383ac proto kernel metric 256 pref medium
|
||||||
|
fd00:26::/64 dev br-263c8508de6f proto kernel metric 256 pref medium
|
||||||
|
fd00:27::/64 dev br-87e08370adff proto kernel metric 256 pref medium
|
||||||
|
fd00:28::/64 dev br-ed1bb1cc9d39 proto kernel metric 256 pref medium
|
||||||
|
fd00:29::/64 dev br-f10b040acc46 proto kernel metric 256 pref medium
|
||||||
|
fd00:30::/64 dev br-dc41f9983a47 proto kernel metric 256 pref medium
|
||||||
|
fd00:31::/64 dev br-f3f5c7cfa74e proto kernel metric 256 pref medium
|
||||||
|
fd00:40::/64 dev br-8b881e367322 proto kernel metric 256 linkdown pref medium
|
||||||
|
fd00:41::/64 dev br-051bbcfc21d8 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethf79d976 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev docker0 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth605aea1 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-5a9988b94efd proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethca028f8 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-e02b7c89a2d3 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-dee363d4e0c6 proto kernel metric 256 linkdown pref medium
|
||||||
|
fe80::/64 dev br-875fced92cd0 proto kernel metric 256 linkdown pref medium
|
||||||
|
fe80::/64 dev vethf583175 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-11ceaf8736f5 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth880eb86 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth7e2863d proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth55cb2ec proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethee5b2b0 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-9aea00f5a485 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethbe8f01c proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-b7976abb6e55 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth2edd7d6 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-68e2ed0ec6ac proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth38ae454 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-cfae917b997e proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth563d3b9 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-ecba5adea6ea proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth766794b proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-d89dcf384c2a proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth426f4c7 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth362d4c6 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth2d01312 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth4ecfbb5 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth99bb318 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethcae9493 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth8c83268 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth6f6f074 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth4216565 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth46248ff proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethc0ef06c proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethaeee758 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-f63e542ab28c proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-8b881e367322 proto kernel metric 256 linkdown pref medium
|
||||||
|
fe80::/64 dev veth2906c94 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-6caddd639b0b proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethbb40f36 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-2d50ca7a8f5d proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth6594ba0 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-dc41f9983a47 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth28958e3 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth1f2dc82 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth04a7fbe proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth2273529 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth160d05f proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-eeee48934935 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethd88eb9b proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-f10b040acc46 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth80da983 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth2bde217 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth9e2bcbb proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth0477205 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-87e08370adff proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth370f490 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-ed1bb1cc9d39 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethca0ee65 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth4692f5c proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethd14eb7e proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-527a7cd84ff6 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth3c1861e proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-03ee8c9e4bea proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth32d5964 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vetha548a1a proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth762d601 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethf48aa55 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethf5f3d34 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-f3f5c7cfa74e proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth335556c proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth9cc2ad8 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth6232cb7 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth337e2fd proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth7d6d658 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth448a204 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth79ea708 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth4ba8ed1 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-263c8508de6f proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth4a87e58 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-fea0382ed10b proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethacfaa19 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth30db54a proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethe969d14 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth0e4600c proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth21e2097 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-f9343d8383ac proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth58179de proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-59ca07fbf200 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth6b9d50d proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth2445f8e proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth368657c proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth5f6906b proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth2dd045f proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth53fd806 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth2b9371a proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-051bbcfc21d8 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth165b4aa proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth8c376e6 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth73c775b proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth56166e3 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-4efe811b8402 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth14193e1 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethe9fcee3 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth71028db proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-bca9ecea74f1 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethe123758 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-a35cbfd37253 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth8d698e0 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-71bcae37092b proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethd87ba34 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth1bece5c proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-c50ccbc5e464 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth6091231 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth502e53b proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethe6c6432 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-618855db6757 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth1f1f066 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth26a5545 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethe488043 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-28584d053169 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth551b749 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth15eb212 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-4ecbee63f4b0 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth41b1943 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev vethc2b3531 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth62aa43d proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-8200b83f03e9 proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev veth081c8bf proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev br-9891a93b5e9c proto kernel metric 256 pref medium
|
||||||
|
fe80::/64 dev enp4s0 proto kernel metric 1024 pref medium
|
||||||
|
default via fe80::3e8c:f8ff:fef4:2590 dev enp4s0 proto ra metric 100 pref medium
|
||||||
|
local ::1 dev lo table local proto kernel metric 0 pref medium
|
||||||
|
anycast 2603:7080:7500:1279:: dev enp4s0 table local proto kernel metric 0 pref medium
|
||||||
|
local 2603:7080:7500:1279:75aa:d64d:4cf0:8f10 dev enp4s0 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:1:: dev br-5a9988b94efd table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:1::1 dev br-5a9988b94efd table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:3:: dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:3::1 dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:4:: dev br-f63e542ab28c table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:4::1 dev br-f63e542ab28c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:9:: dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:9::1 dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:10:: dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:10::1 dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:16:: dev br-618855db6757 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:16::1 dev br-618855db6757 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:17:: dev br-28584d053169 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:17::1 dev br-28584d053169 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:18:: dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:18::1 dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:20:: dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:20::1 dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:24:: dev br-f9343d8383ac table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:24::1 dev br-f9343d8383ac table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:26:: dev br-263c8508de6f table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:26::1 dev br-263c8508de6f table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:27:: dev br-87e08370adff table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:27::1 dev br-87e08370adff table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:28:: dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:28::1 dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:29:: dev br-f10b040acc46 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:29::1 dev br-f10b040acc46 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:30:: dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:30::1 dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:31:: dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:31::1 dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:40:: dev br-8b881e367322 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:40::1 dev br-8b881e367322 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fd00:41:: dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
|
||||||
|
local fd00:41::1 dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev enp4s0 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth605aea1 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethf79d976 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-5a9988b94efd table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev docker0 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-dee363d4e0c6 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethca028f8 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethf583175 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-e02b7c89a2d3 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-875fced92cd0 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-11ceaf8736f5 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth880eb86 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethee5b2b0 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth55cb2ec table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth766794b table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth38ae454 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethbe8f01c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth563d3b9 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-b7976abb6e55 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-68e2ed0ec6ac table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth7e2863d table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-cfae917b997e table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth4216565 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth2edd7d6 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethcae9493 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth426f4c7 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-ecba5adea6ea table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth2d01312 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth8c83268 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth362d4c6 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth6f6f074 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth99bb318 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-d89dcf384c2a table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-8b881e367322 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth4ecfbb5 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethc0ef06c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth46248ff table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethaeee758 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethbb40f36 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-2d50ca7a8f5d table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-6caddd639b0b table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-f63e542ab28c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth04a7fbe table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth2906c94 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth28958e3 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth1f2dc82 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-f10b040acc46 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethd88eb9b table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth6594ba0 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth2273529 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-eeee48934935 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth160d05f table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth2bde217 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth80da983 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth9e2bcbb table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth370f490 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-87e08370adff table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth0477205 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethd14eb7e table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth3c1861e table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vetha548a1a table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethca0ee65 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethf48aa55 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth32d5964 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-03ee8c9e4bea table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth4692f5c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth79ea708 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth7d6d658 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth9cc2ad8 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth6232cb7 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth762d601 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth337e2fd table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth335556c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth4ba8ed1 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-fea0382ed10b table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethf5f3d34 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth448a204 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-263c8508de6f table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth4a87e58 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethe969d14 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth0e4600c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth21e2097 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth30db54a table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethacfaa19 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-f9343d8383ac table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-59ca07fbf200 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth6b9d50d table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth2dd045f table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth2445f8e table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth58179de table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth368657c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth5f6906b table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth165b4aa table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth53fd806 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth8c376e6 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth2b9371a table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth56166e3 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth73c775b table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-4efe811b8402 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethe9fcee3 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth14193e1 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth71028db table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-a35cbfd37253 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth8d698e0 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethe123758 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-71bcae37092b table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth6091231 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethd87ba34 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth1bece5c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-c50ccbc5e464 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth26a5545 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth502e53b table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethe6c6432 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-618855db6757 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth1f1f066 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethe488043 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-28584d053169 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth41b1943 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth551b749 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth15eb212 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev vethc2b3531 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth62aa43d table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev br-9891a93b5e9c table local proto kernel metric 0 pref medium
|
||||||
|
anycast fe80:: dev veth081c8bf table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::63:73ff:fede:43f9 dev vethbe8f01c table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::424:9bff:fe91:317e dev veth762d601 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::443:71ff:feac:bdfb dev vethe9fcee3 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::464:d7ff:fea1:a54a dev veth2dd045f table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::4a3:bbff:fea9:df98 dev veth99bb318 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::869:a1ff:fee9:63a6 dev veth2273529 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::c1f:b5ff:fe0a:c936 dev vethca0ee65 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::e6f:317c:ee82:e5e dev enp4s0 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::1058:f8ff:fe69:21bb dev br-68e2ed0ec6ac table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::18c7:26ff:fe8b:bea4 dev veth46248ff table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::1c13:3ff:fe18:c9a4 dev veth2906c94 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::1c6e:c5ff:fe94:c515 dev veth3c1861e table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::2095:66ff:fe78:518e dev veth4ba8ed1 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::24de:7fff:fef9:e7af dev veth2bde217 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::2844:4dff:fec7:1613 dev vethcae9493 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::286c:a2ff:fe49:5772 dev br-71bcae37092b table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::28b8:bdff:fe81:370f dev veth55cb2ec table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::28df:aff:fe50:a6d2 dev br-f63e542ab28c table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::2c30:58ff:fe89:f9d2 dev br-e02b7c89a2d3 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::2c60:58ff:fe86:30d3 dev veth4692f5c table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::303f:6ff:fe24:1fa6 dev vethe969d14 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::30d4:6bff:fe54:5fb3 dev br-ed1bb1cc9d39 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::30f1:2cff:feac:90cb dev veth1bece5c table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::3441:76ff:fe3f:f8d1 dev veth766794b table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::3c0c:90ff:fe10:332f dev veth2edd7d6 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::3c1f:f9ff:fe36:4122 dev veth081c8bf table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::3c6e:51ff:fe48:e037 dev vetha548a1a table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::40f5:bfff:fed7:8296 dev br-87e08370adff table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::4421:95ff:fe94:d7c5 dev br-bca9ecea74f1 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::4463:6dff:fe29:79d5 dev veth4216565 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::4482:41ff:feb3:9c74 dev br-527a7cd84ff6 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::44ee:8eff:fe1a:bcf4 dev vethe123758 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::48e9:9ff:fea5:2c72 dev docker0 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::48ec:7cff:fe17:27bc dev veth0477205 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::4c52:c7ff:fe49:3b0e dev vethf79d976 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::4c63:fcff:fe4c:7d6a dev br-f10b040acc46 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::4c80:8fff:feec:15d4 dev br-8200b83f03e9 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::502a:e5ff:fe5c:d5fa dev veth5f6906b table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::5030:beff:fead:c50a dev veth9e2bcbb table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::50f3:d6ff:fedd:1cd3 dev veth160d05f table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::542a:61ff:fe38:307c dev veth8c376e6 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::5455:fbff:fec6:391e dev veth2d01312 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::548d:1eff:fe36:12c5 dev br-2d50ca7a8f5d table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::548d:f8ff:fef4:c0db dev veth880eb86 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::5852:d0ff:fe9e:545 dev vethc0ef06c table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::5c80:75ff:feff:22dd dev veth15eb212 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::60fc:94ff:fe7d:a58f dev br-cfae917b997e table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::6486:bfff:fee7:22df dev vethee5b2b0 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::64fe:2aff:fed1:1e41 dev veth6232cb7 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::68b1:bff:fee2:9d17 dev br-9aea00f5a485 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::6c50:96ff:fe29:70a6 dev veth9cc2ad8 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::6c7e:7fff:fe2a:bf1d dev br-875fced92cd0 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::6c9c:c1ff:fe95:888e dev br-fea0382ed10b table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::6cb5:cff:fea2:a675 dev veth58179de table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::7069:c0ff:febd:1d88 dev vethe488043 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::7462:7dff:fe8f:115d dev veth73c775b table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::74c2:12ff:fe72:7875 dev veth426f4c7 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::78cf:3dff:fe72:528b dev br-dc41f9983a47 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::7c42:75ff:fe80:5953 dev veth551b749 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::7c73:c8ff:fe04:3dd2 dev br-28584d053169 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::7cdd:44ff:fe90:1f77 dev veth53fd806 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::805a:47ff:fe53:cfcd dev vethf48aa55 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::80a3:1eff:fe61:4f10 dev veth32d5964 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::80fb:8fff:fead:2208 dev veth7d6d658 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::84bf:b2ff:fec4:ea7 dev vethd14eb7e table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::8832:52ff:fee4:8a93 dev veth8c83268 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::888d:45ff:feeb:4a48 dev veth26a5545 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::9091:4aff:feee:8942 dev veth6594ba0 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::90da:e3ff:fefa:7464 dev veth1f1f066 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::90ed:30ff:fe51:2b5a dev veth335556c table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::90ed:f4ff:feed:a749 dev vethacfaa19 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::90ff:b0ff:fe58:21fb dev veth448a204 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::9879:f6ff:fe6d:57be dev br-c50ccbc5e464 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::a047:6eff:fe8b:1f48 dev veth502e53b table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::a065:bfff:fea5:34 dev veth368657c table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::a065:eaff:fef3:532d dev br-11ceaf8736f5 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::a0eb:3bff:fe66:df68 dev veth80da983 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::a4a0:13ff:fe7f:7c8d dev vethd88eb9b table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::a4ab:b9ff:fe3e:af94 dev veth71028db table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::a843:f3ff:fedb:ef64 dev br-5a9988b94efd table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::a8fe:4ff:fe1f:d81a dev br-b7976abb6e55 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::ac43:75ff:fefa:cbfd dev veth79ea708 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::ac5e:9cff:fe45:ec06 dev veth7e2863d table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::ac67:76ff:fe15:1676 dev veth6f6f074 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::ac86:86ff:fe64:f2d4 dev br-eeee48934935 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::aca7:12ff:fe18:d1b9 dev br-a35cbfd37253 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::aca7:68ff:fe42:e77 dev veth14193e1 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::aca8:14ff:feee:df7c dev br-618855db6757 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::acc5:57ff:fece:3b51 dev veth62aa43d table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::b441:acff:fe66:5981 dev veth0e4600c table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::b471:19ff:fe52:ff1 dev br-d89dcf384c2a table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::b48b:1aff:fe71:36d3 dev veth21e2097 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::b4d5:57ff:fe87:83f9 dev vethc2b3531 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::b86e:58ff:fef5:85f6 dev br-dee363d4e0c6 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::bc01:62ff:fe13:b616 dev veth41b1943 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::c000:96ff:fe7d:11a8 dev vethbb40f36 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::c006:5ff:fea6:b743 dev vethf5f3d34 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::c030:54ff:fe2d:eb36 dev br-8b881e367322 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::c090:5eff:fed8:d1cc dev veth370f490 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::c0da:5bff:fea4:92dc dev br-6caddd639b0b table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::c85e:5aff:feaa:f812 dev veth165b4aa table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::c899:1fff:fe27:7f66 dev veth4a87e58 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::c8b0:56ff:fe7e:bc48 dev br-f9343d8383ac table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::cc80:50ff:feb5:67b dev veth2445f8e table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::ccd1:f1ff:fe0f:c699 dev vethca028f8 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d037:82ff:fee7:27c5 dev veth28958e3 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d037:e3ff:fe79:1a5f dev veth563d3b9 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d44c:3bff:fe3b:934f dev veth2b9371a table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d44d:feff:fe18:d291 dev veth6091231 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d457:2bff:fe72:23f dev br-051bbcfc21d8 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d45e:64ff:fe90:37e7 dev veth6b9d50d table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d847:aaff:fe89:3f9 dev veth4ecfbb5 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d86b:4fff:fec2:50e0 dev veth8d698e0 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d87e:fbff:fec6:5aeb dev br-4efe811b8402 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::d8c8:aaff:fe63:6af9 dev br-263c8508de6f table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::dc0f:5dff:fec4:7c53 dev veth56166e3 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::e0a6:32ff:fe63:9f8d dev br-9891a93b5e9c table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::e447:bff:feea:1f61 dev vethe6c6432 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::e46c:23ff:fec3:3ab9 dev br-4ecbee63f4b0 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::e488:ccff:fe2f:e545 dev veth04a7fbe table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::e49e:23ff:feb7:932d dev veth1f2dc82 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::e807:c7ff:fee0:f12d dev vethaeee758 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::e855:acff:fef2:5aa3 dev veth30db54a table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::e87f:edff:fe10:e8d6 dev vethd87ba34 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::ec3f:78ff:fe38:75b9 dev veth605aea1 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::f01a:4eff:fef2:9942 dev veth38ae454 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::f01f:e5ff:fe2b:ec80 dev br-03ee8c9e4bea table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::f038:dbff:fefd:87d3 dev veth362d4c6 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::f0bf:5ff:fee7:2b1e dev veth337e2fd table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::f0c3:fff:fe8b:74e3 dev vethf583175 table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::f4a6:b6ff:fe24:af71 dev br-f3f5c7cfa74e table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::f8d4:eff:fe6e:19a9 dev br-ecba5adea6ea table local proto kernel metric 0 pref medium
|
||||||
|
local fe80::fc79:ccff:fefd:20d7 dev br-59ca07fbf200 table local proto kernel metric 0 pref medium
|
||||||
|
multicast ff00::/8 dev enp4s0 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev wg0 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethf79d976 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev docker0 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth605aea1 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-5a9988b94efd table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethca028f8 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-e02b7c89a2d3 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-dee363d4e0c6 table local proto kernel metric 256 linkdown pref medium
|
||||||
|
multicast ff00::/8 dev br-875fced92cd0 table local proto kernel metric 256 linkdown pref medium
|
||||||
|
multicast ff00::/8 dev vethf583175 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-11ceaf8736f5 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth880eb86 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth7e2863d table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth55cb2ec table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethee5b2b0 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-9aea00f5a485 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethbe8f01c table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-b7976abb6e55 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth2edd7d6 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-68e2ed0ec6ac table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth38ae454 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-cfae917b997e table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth563d3b9 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-ecba5adea6ea table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth766794b table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-d89dcf384c2a table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth426f4c7 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth362d4c6 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth2d01312 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth4ecfbb5 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth99bb318 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethcae9493 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth8c83268 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth6f6f074 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth4216565 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth46248ff table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethc0ef06c table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethaeee758 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-f63e542ab28c table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-8b881e367322 table local proto kernel metric 256 linkdown pref medium
|
||||||
|
multicast ff00::/8 dev veth2906c94 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-6caddd639b0b table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethbb40f36 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-2d50ca7a8f5d table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth6594ba0 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-dc41f9983a47 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth28958e3 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth1f2dc82 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth04a7fbe table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth2273529 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth160d05f table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-eeee48934935 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethd88eb9b table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-f10b040acc46 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth80da983 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth2bde217 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth9e2bcbb table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth0477205 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-87e08370adff table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth370f490 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-ed1bb1cc9d39 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethca0ee65 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth4692f5c table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethd14eb7e table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-527a7cd84ff6 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth3c1861e table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-03ee8c9e4bea table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth32d5964 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vetha548a1a table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth762d601 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethf48aa55 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethf5f3d34 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-f3f5c7cfa74e table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth335556c table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth9cc2ad8 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth6232cb7 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth337e2fd table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth7d6d658 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth448a204 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth79ea708 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth4ba8ed1 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-263c8508de6f table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth4a87e58 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-fea0382ed10b table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethacfaa19 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth30db54a table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethe969d14 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth0e4600c table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth21e2097 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-f9343d8383ac table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth58179de table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-59ca07fbf200 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth6b9d50d table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth2445f8e table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth368657c table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth5f6906b table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth2dd045f table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth53fd806 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth2b9371a table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-051bbcfc21d8 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth165b4aa table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth8c376e6 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth73c775b table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth56166e3 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-4efe811b8402 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth14193e1 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethe9fcee3 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth71028db table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-bca9ecea74f1 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethe123758 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-a35cbfd37253 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth8d698e0 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-71bcae37092b table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethd87ba34 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth1bece5c table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-c50ccbc5e464 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth6091231 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth502e53b table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethe6c6432 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-618855db6757 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth1f1f066 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth26a5545 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethe488043 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-28584d053169 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth551b749 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth15eb212 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-4ecbee63f4b0 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth41b1943 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev vethc2b3531 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth62aa43d table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-8200b83f03e9 table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev veth081c8bf table local proto kernel metric 256 pref medium
|
||||||
|
multicast ff00::/8 dev br-9891a93b5e9c table local proto kernel metric 256 pref medium
|
||||||
|
|
||||||
|
=== IPv4 rules ===
|
||||||
|
0: from all lookup local
|
||||||
|
32765: from 10.98.0.2 lookup wg0
|
||||||
|
32766: from all lookup main
|
||||||
|
32767: from all lookup default
|
||||||
|
|
||||||
|
=== IPv6 rules ===
|
||||||
|
0: from all lookup local
|
||||||
|
32766: from all lookup main
|
||||||
|
|
||||||
|
=== namespaces ===
|
||||||
|
|
||||||
|
=== resolvers ===
|
||||||
|
# Generated by NetworkManager
|
||||||
|
search lan
|
||||||
|
nameserver 192.168.10.1
|
||||||
|
nameserver fe80::3e8c:f8ff:fef4:2590%enp4s0
|
||||||
|
|
||||||
|
=== observed public IPv4 ===
|
||||||
|
74.67.173.56
|
||||||
|
|
||||||
|
=== observed public IPv6 ===
|
||||||
|
2603:7080:7500:1279:75aa:d64d:4cf0:8f10
|
||||||
|
|
@ -0,0 +1,702 @@
|
||||||
|
# Warning: table ip filter is managed by iptables-nft, do not touch!
|
||||||
|
table ip filter { # handle 1
|
||||||
|
chain INPUT { # handle 1
|
||||||
|
type filter hook input priority filter; policy accept;
|
||||||
|
}
|
||||||
|
|
||||||
|
chain FORWARD { # handle 2
|
||||||
|
type filter hook forward priority filter; policy accept;
|
||||||
|
counter packets 1393654 bytes 658721511 jump DOCKER-USER # handle 170
|
||||||
|
counter packets 1393654 bytes 658721511 jump DOCKER-FORWARD # handle 9
|
||||||
|
}
|
||||||
|
|
||||||
|
chain OUTPUT { # handle 3
|
||||||
|
type filter hook output priority filter; policy accept;
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER { # handle 4
|
||||||
|
ip daddr 172.31.0.2 iifname != "br-9891a93b5e9c" oifname "br-9891a93b5e9c" tcp dport 8945 counter packets 0 bytes 0 accept # handle 463
|
||||||
|
ip daddr 10.9.0.2 iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 accept # handle 458
|
||||||
|
ip daddr 10.17.0.2 iifname != "br-28584d053169" oifname "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 accept # handle 446
|
||||||
|
ip daddr 10.1.0.6 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 accept # handle 441
|
||||||
|
ip daddr 10.19.0.3 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5030 counter packets 0 bytes 0 accept # handle 435
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 9696 counter packets 0 bytes 0 accept # handle 434
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8989 counter packets 0 bytes 0 accept # handle 433
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8888 counter packets 0 bytes 0 accept # handle 432
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8787 counter packets 0 bytes 0 accept # handle 431
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8265 counter packets 0 bytes 0 accept # handle 430
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8191 counter packets 0 bytes 0 accept # handle 429
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 8080 counter packets 0 bytes 0 accept # handle 428
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 7878 counter packets 0 bytes 0 accept # handle 427
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 6767 counter packets 0 bytes 0 accept # handle 426
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5075 counter packets 0 bytes 0 accept # handle 425
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5055 counter packets 0 bytes 0 accept # handle 424
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" tcp dport 5000 counter packets 0 bytes 0 accept # handle 423
|
||||||
|
ip daddr 172.30.0.3 iifname != "br-71bcae37092b" oifname "br-71bcae37092b" tcp dport 8080 counter packets 0 bytes 0 accept # handle 418
|
||||||
|
ip daddr 10.13.0.2 iifname != "br-a35cbfd37253" oifname "br-a35cbfd37253" tcp dport 8000 counter packets 0 bytes 0 accept # handle 413
|
||||||
|
ip daddr 10.10.0.2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 443 counter packets 0 bytes 0 accept # handle 408
|
||||||
|
ip daddr 10.10.0.2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 80 counter packets 0 bytes 0 accept # handle 407
|
||||||
|
ip daddr 10.99.0.16 iifname != "br-e02b7c89a2d3" oifname "br-e02b7c89a2d3" tcp dport 9000 counter packets 0 bytes 0 accept # handle 402
|
||||||
|
ip daddr 10.1.0.5 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 8080 counter packets 0 bytes 0 accept # handle 397
|
||||||
|
ip daddr 10.1.0.3 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 80 counter packets 0 bytes 0 accept # handle 391
|
||||||
|
ip daddr 10.24.0.2 iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" tcp dport 8080 counter packets 0 bytes 0 accept # handle 386
|
||||||
|
ip daddr 172.26.0.5 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 80 counter packets 0 bytes 0 accept # handle 381
|
||||||
|
ip daddr 172.26.0.4 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" udp dport 10009 counter packets 0 bytes 0 accept # handle 380
|
||||||
|
ip daddr 172.26.0.4 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 9090 counter packets 0 bytes 0 accept # handle 379
|
||||||
|
ip daddr 172.26.0.3 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 8888 counter packets 0 bytes 0 accept # handle 378
|
||||||
|
ip daddr 172.26.0.2 iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" tcp dport 5280 counter packets 0 bytes 0 accept # handle 377
|
||||||
|
ip daddr 10.26.0.2 iifname != "br-263c8508de6f" oifname "br-263c8508de6f" tcp dport 6167 counter packets 0 bytes 0 accept # handle 372
|
||||||
|
ip daddr 10.31.0.5 iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" tcp dport 4000 counter packets 0 bytes 0 accept # handle 367
|
||||||
|
ip daddr 10.31.0.4 iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" tcp dport 3000 counter packets 0 bytes 0 accept # handle 366
|
||||||
|
ip daddr 10.31.0.2 iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" tcp dport 9200 counter packets 0 bytes 0 accept # handle 363
|
||||||
|
ip daddr 172.28.0.5 iifname != "br-03ee8c9e4bea" oifname "br-03ee8c9e4bea" tcp dport 8536 counter packets 0 bytes 0 accept # handle 358
|
||||||
|
ip daddr 172.28.0.5 iifname != "br-03ee8c9e4bea" oifname "br-03ee8c9e4bea" tcp dport 1236 counter packets 0 bytes 0 accept # handle 357
|
||||||
|
ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" tcp dport 8097 counter packets 0 bytes 0 accept # handle 352
|
||||||
|
ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" tcp dport 6697 counter packets 1 bytes 52 accept # handle 351
|
||||||
|
ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" tcp dport 6667 counter packets 0 bytes 0 accept # handle 350
|
||||||
|
ip daddr 10.28.0.3 iifname != "br-ed1bb1cc9d39" oifname "br-ed1bb1cc9d39" tcp dport 8080 counter packets 0 bytes 0 accept # handle 345
|
||||||
|
ip daddr 10.27.0.2 iifname != "br-87e08370adff" oifname "br-87e08370adff" tcp dport 3000 counter packets 0 bytes 0 accept # handle 340
|
||||||
|
ip daddr 10.27.0.2 iifname != "br-87e08370adff" oifname "br-87e08370adff" tcp dport 2244 counter packets 0 bytes 0 accept # handle 339
|
||||||
|
ip daddr 10.29.0.3 iifname != "br-f10b040acc46" oifname "br-f10b040acc46" tcp dport 3000 counter packets 0 bytes 0 accept # handle 332
|
||||||
|
ip daddr 172.24.0.2 iifname != "br-eeee48934935" oifname "br-eeee48934935" tcp dport 7576 counter packets 0 bytes 0 accept # handle 326
|
||||||
|
ip daddr 10.30.0.4 iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" tcp dport 80 counter packets 0 bytes 0 accept # handle 321
|
||||||
|
ip daddr 172.23.0.2 iifname != "br-2d50ca7a8f5d" oifname "br-2d50ca7a8f5d" tcp dport 8080 counter packets 0 bytes 0 accept # handle 316
|
||||||
|
ip daddr 172.23.0.2 iifname != "br-2d50ca7a8f5d" oifname "br-2d50ca7a8f5d" tcp dport 1935 counter packets 0 bytes 0 accept # handle 315
|
||||||
|
ip daddr 172.22.0.2 iifname != "br-6caddd639b0b" oifname "br-6caddd639b0b" tcp dport 8765 counter packets 0 bytes 0 accept # handle 310
|
||||||
|
ip daddr 10.4.0.2 iifname != "br-f63e542ab28c" oifname "br-f63e542ab28c" tcp dport 80 counter packets 0 bytes 0 accept # handle 299
|
||||||
|
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 993 counter packets 33 bytes 1948 accept # handle 294
|
||||||
|
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 465 counter packets 23 bytes 1252 accept # handle 293
|
||||||
|
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 443 counter packets 0 bytes 0 accept # handle 292
|
||||||
|
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 80 counter packets 0 bytes 0 accept # handle 291
|
||||||
|
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" tcp dport 25 counter packets 500 bytes 29920 accept # handle 290
|
||||||
|
ip daddr 10.3.0.2 iifname != "br-9aea00f5a485" oifname "br-9aea00f5a485" tcp dport 8888 counter packets 0 bytes 0 accept # handle 271
|
||||||
|
ip daddr 10.55.0.3 iifname != "br-11ceaf8736f5" oifname "br-11ceaf8736f5" tcp dport 7001 counter packets 0 bytes 0 accept # handle 207
|
||||||
|
ip daddr 10.55.0.2 iifname != "br-11ceaf8736f5" oifname "br-11ceaf8736f5" tcp dport 3000 counter packets 0 bytes 0 accept # handle 199
|
||||||
|
ip daddr 172.17.0.4 iifname != "docker0" oifname "docker0" tcp dport 5432 counter packets 0 bytes 0 accept # handle 183
|
||||||
|
ip daddr 172.17.0.3 iifname != "docker0" oifname "docker0" tcp dport 3306 counter packets 0 bytes 0 accept # handle 177
|
||||||
|
iifname != "br-11ceaf8736f5" oifname "br-11ceaf8736f5" counter packets 0 bytes 0 drop # handle 18
|
||||||
|
iifname != "br-dee363d4e0c6" oifname "br-dee363d4e0c6" counter packets 0 bytes 0 drop # handle 26
|
||||||
|
iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 73
|
||||||
|
iifname != "br-e02b7c89a2d3" oifname "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 137
|
||||||
|
iifname != "br-875fced92cd0" oifname "br-875fced92cd0" counter packets 0 bytes 0 drop # handle 153
|
||||||
|
iifname != "docker0" oifname "docker0" counter packets 0 bytes 0 drop # handle 172
|
||||||
|
iifname != "br-9aea00f5a485" oifname "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 268
|
||||||
|
iifname != "br-68e2ed0ec6ac" oifname "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 273
|
||||||
|
iifname != "br-b7976abb6e55" oifname "br-b7976abb6e55" counter packets 0 bytes 0 drop # handle 277
|
||||||
|
iifname != "br-cfae917b997e" oifname "br-cfae917b997e" counter packets 0 bytes 0 drop # handle 284
|
||||||
|
iifname != "br-f63e542ab28c" oifname "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 296
|
||||||
|
iifname != "br-8b881e367322" oifname "br-8b881e367322" counter packets 0 bytes 0 drop # handle 301
|
||||||
|
iifname != "br-6caddd639b0b" oifname "br-6caddd639b0b" counter packets 0 bytes 0 drop # handle 307
|
||||||
|
iifname != "br-2d50ca7a8f5d" oifname "br-2d50ca7a8f5d" counter packets 0 bytes 0 drop # handle 312
|
||||||
|
iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 318
|
||||||
|
iifname != "br-eeee48934935" oifname "br-eeee48934935" counter packets 0 bytes 0 drop # handle 323
|
||||||
|
iifname != "br-f10b040acc46" oifname "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 328
|
||||||
|
iifname != "br-87e08370adff" oifname "br-87e08370adff" counter packets 0 bytes 0 drop # handle 334
|
||||||
|
iifname != "br-ed1bb1cc9d39" oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 342
|
||||||
|
iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 347
|
||||||
|
iifname != "br-03ee8c9e4bea" oifname "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 354
|
||||||
|
iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 360
|
||||||
|
iifname != "br-263c8508de6f" oifname "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 369
|
||||||
|
iifname != "br-fea0382ed10b" oifname "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 374
|
||||||
|
iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 383
|
||||||
|
iifname != "br-59ca07fbf200" oifname "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 388
|
||||||
|
iifname != "br-051bbcfc21d8" oifname "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 393
|
||||||
|
iifname != "br-4efe811b8402" oifname "br-4efe811b8402" counter packets 0 bytes 0 drop # handle 399
|
||||||
|
iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 404
|
||||||
|
iifname != "br-a35cbfd37253" oifname "br-a35cbfd37253" counter packets 0 bytes 0 drop # handle 410
|
||||||
|
iifname != "br-71bcae37092b" oifname "br-71bcae37092b" counter packets 0 bytes 0 drop # handle 415
|
||||||
|
iifname != "br-c50ccbc5e464" oifname "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 420
|
||||||
|
iifname != "br-618855db6757" oifname "br-618855db6757" counter packets 0 bytes 0 drop # handle 437
|
||||||
|
iifname != "br-28584d053169" oifname "br-28584d053169" counter packets 0 bytes 0 drop # handle 443
|
||||||
|
iifname != "br-4ecbee63f4b0" oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 448
|
||||||
|
iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 455
|
||||||
|
iifname != "br-9891a93b5e9c" oifname "br-9891a93b5e9c" counter packets 0 bytes 0 drop # handle 460
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-FORWARD { # handle 5
|
||||||
|
counter packets 1393654 bytes 658721511 jump DOCKER-CT # handle 12
|
||||||
|
counter packets 811898 bytes 429419843 jump DOCKER-INTERNAL # handle 11
|
||||||
|
counter packets 811898 bytes 429419843 jump DOCKER-BRIDGE # handle 10
|
||||||
|
iifname "br-11ceaf8736f5" counter packets 3260 bytes 175561 accept # handle 17
|
||||||
|
iifname "br-dee363d4e0c6" counter packets 0 bytes 0 accept # handle 25
|
||||||
|
iifname "br-5a9988b94efd" counter packets 185 bytes 27196 accept # handle 72
|
||||||
|
iifname "br-e02b7c89a2d3" counter packets 46734 bytes 8416975 accept # handle 136
|
||||||
|
iifname "br-875fced92cd0" counter packets 0 bytes 0 accept # handle 152
|
||||||
|
iifname "docker0" counter packets 0 bytes 0 accept # handle 171
|
||||||
|
iifname "br-9aea00f5a485" counter packets 0 bytes 0 accept # handle 267
|
||||||
|
iifname "br-68e2ed0ec6ac" counter packets 492 bytes 40183 accept # handle 272
|
||||||
|
iifname "br-b7976abb6e55" counter packets 10668 bytes 5341503 accept # handle 276
|
||||||
|
iifname "br-ecba5adea6ea" oifname "br-ecba5adea6ea" counter packets 0 bytes 0 accept # handle 282
|
||||||
|
iifname "br-cfae917b997e" counter packets 43 bytes 4954 accept # handle 283
|
||||||
|
iifname "br-d89dcf384c2a" oifname "br-d89dcf384c2a" counter packets 0 bytes 0 accept # handle 289
|
||||||
|
iifname "br-f63e542ab28c" counter packets 0 bytes 0 accept # handle 295
|
||||||
|
iifname "br-8b881e367322" counter packets 135 bytes 13854 accept # handle 300
|
||||||
|
iifname "br-6caddd639b0b" counter packets 0 bytes 0 accept # handle 306
|
||||||
|
iifname "br-2d50ca7a8f5d" counter packets 0 bytes 0 accept # handle 311
|
||||||
|
iifname "br-dc41f9983a47" counter packets 0 bytes 0 accept # handle 317
|
||||||
|
iifname "br-eeee48934935" counter packets 46 bytes 3053 accept # handle 322
|
||||||
|
iifname "br-f10b040acc46" counter packets 1774 bytes 177630 accept # handle 327
|
||||||
|
iifname "br-87e08370adff" counter packets 0 bytes 0 accept # handle 333
|
||||||
|
iifname "br-ed1bb1cc9d39" counter packets 15 bytes 1717 accept # handle 341
|
||||||
|
iifname "br-527a7cd84ff6" counter packets 3 bytes 132 accept # handle 346
|
||||||
|
iifname "br-03ee8c9e4bea" counter packets 6089 bytes 353878 accept # handle 353
|
||||||
|
iifname "br-f3f5c7cfa74e" counter packets 639 bytes 70250 accept # handle 359
|
||||||
|
iifname "br-263c8508de6f" counter packets 24004 bytes 2190194 accept # handle 368
|
||||||
|
iifname "br-fea0382ed10b" counter packets 134 bytes 30967 accept # handle 373
|
||||||
|
iifname "br-f9343d8383ac" counter packets 0 bytes 0 accept # handle 382
|
||||||
|
iifname "br-59ca07fbf200" counter packets 0 bytes 0 accept # handle 387
|
||||||
|
iifname "br-051bbcfc21d8" counter packets 0 bytes 0 accept # handle 392
|
||||||
|
iifname "br-4efe811b8402" counter packets 0 bytes 0 accept # handle 398
|
||||||
|
iifname "br-bca9ecea74f1" counter packets 0 bytes 0 accept # handle 403
|
||||||
|
iifname "br-a35cbfd37253" counter packets 0 bytes 0 accept # handle 409
|
||||||
|
iifname "br-71bcae37092b" counter packets 0 bytes 0 accept # handle 414
|
||||||
|
iifname "br-c50ccbc5e464" counter packets 637050 bytes 401364749 accept # handle 419
|
||||||
|
iifname "br-618855db6757" counter packets 0 bytes 0 accept # handle 436
|
||||||
|
iifname "br-28584d053169" counter packets 12 bytes 1526 accept # handle 442
|
||||||
|
iifname "br-4ecbee63f4b0" counter packets 0 bytes 0 accept # handle 447
|
||||||
|
iifname "br-8200b83f03e9" counter packets 52 bytes 6434 accept # handle 454
|
||||||
|
iifname "br-9891a93b5e9c" counter packets 5916 bytes 322250 accept # handle 459
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-BRIDGE { # handle 6
|
||||||
|
oifname "br-11ceaf8736f5" counter packets 0 bytes 0 jump DOCKER # handle 20
|
||||||
|
oifname "br-dee363d4e0c6" counter packets 0 bytes 0 jump DOCKER # handle 28
|
||||||
|
oifname "br-5a9988b94efd" counter packets 0 bytes 0 jump DOCKER # handle 75
|
||||||
|
oifname "br-e02b7c89a2d3" counter packets 0 bytes 0 jump DOCKER # handle 139
|
||||||
|
oifname "br-875fced92cd0" counter packets 0 bytes 0 jump DOCKER # handle 155
|
||||||
|
oifname "docker0" counter packets 0 bytes 0 jump DOCKER # handle 174
|
||||||
|
oifname "br-9aea00f5a485" counter packets 0 bytes 0 jump DOCKER # handle 270
|
||||||
|
oifname "br-68e2ed0ec6ac" counter packets 0 bytes 0 jump DOCKER # handle 275
|
||||||
|
oifname "br-b7976abb6e55" counter packets 556 bytes 33120 jump DOCKER # handle 279
|
||||||
|
oifname "br-cfae917b997e" counter packets 0 bytes 0 jump DOCKER # handle 286
|
||||||
|
oifname "br-f63e542ab28c" counter packets 0 bytes 0 jump DOCKER # handle 298
|
||||||
|
oifname "br-8b881e367322" counter packets 0 bytes 0 jump DOCKER # handle 303
|
||||||
|
oifname "br-6caddd639b0b" counter packets 0 bytes 0 jump DOCKER # handle 309
|
||||||
|
oifname "br-2d50ca7a8f5d" counter packets 0 bytes 0 jump DOCKER # handle 314
|
||||||
|
oifname "br-dc41f9983a47" counter packets 0 bytes 0 jump DOCKER # handle 320
|
||||||
|
oifname "br-eeee48934935" counter packets 0 bytes 0 jump DOCKER # handle 325
|
||||||
|
oifname "br-f10b040acc46" counter packets 0 bytes 0 jump DOCKER # handle 330
|
||||||
|
oifname "br-87e08370adff" counter packets 0 bytes 0 jump DOCKER # handle 336
|
||||||
|
oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 jump DOCKER # handle 344
|
||||||
|
oifname "br-527a7cd84ff6" counter packets 1 bytes 52 jump DOCKER # handle 349
|
||||||
|
oifname "br-03ee8c9e4bea" counter packets 0 bytes 0 jump DOCKER # handle 356
|
||||||
|
oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 jump DOCKER # handle 362
|
||||||
|
oifname "br-263c8508de6f" counter packets 0 bytes 0 jump DOCKER # handle 371
|
||||||
|
oifname "br-fea0382ed10b" counter packets 0 bytes 0 jump DOCKER # handle 376
|
||||||
|
oifname "br-f9343d8383ac" counter packets 0 bytes 0 jump DOCKER # handle 385
|
||||||
|
oifname "br-59ca07fbf200" counter packets 0 bytes 0 jump DOCKER # handle 390
|
||||||
|
oifname "br-051bbcfc21d8" counter packets 0 bytes 0 jump DOCKER # handle 395
|
||||||
|
oifname "br-4efe811b8402" counter packets 0 bytes 0 jump DOCKER # handle 401
|
||||||
|
oifname "br-bca9ecea74f1" counter packets 0 bytes 0 jump DOCKER # handle 406
|
||||||
|
oifname "br-a35cbfd37253" counter packets 0 bytes 0 jump DOCKER # handle 412
|
||||||
|
oifname "br-71bcae37092b" counter packets 0 bytes 0 jump DOCKER # handle 417
|
||||||
|
oifname "br-c50ccbc5e464" counter packets 0 bytes 0 jump DOCKER # handle 422
|
||||||
|
oifname "br-618855db6757" counter packets 0 bytes 0 jump DOCKER # handle 439
|
||||||
|
oifname "br-28584d053169" counter packets 0 bytes 0 jump DOCKER # handle 445
|
||||||
|
oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 jump DOCKER # handle 450
|
||||||
|
oifname "br-8200b83f03e9" counter packets 0 bytes 0 jump DOCKER # handle 457
|
||||||
|
oifname "br-9891a93b5e9c" counter packets 0 bytes 0 jump DOCKER # handle 462
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-CT { # handle 7
|
||||||
|
oifname "br-11ceaf8736f5" xt match "conntrack" counter packets 5913 bytes 14315682 accept # handle 19
|
||||||
|
oifname "br-dee363d4e0c6" xt match "conntrack" counter packets 0 bytes 0 accept # handle 27
|
||||||
|
oifname "br-5a9988b94efd" xt match "conntrack" counter packets 260 bytes 99871 accept # handle 74
|
||||||
|
oifname "br-e02b7c89a2d3" xt match "conntrack" counter packets 45927 bytes 21960391 accept # handle 138
|
||||||
|
oifname "br-875fced92cd0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 154
|
||||||
|
oifname "docker0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 173
|
||||||
|
oifname "br-9aea00f5a485" xt match "conntrack" counter packets 0 bytes 0 accept # handle 269
|
||||||
|
oifname "br-68e2ed0ec6ac" xt match "conntrack" counter packets 451 bytes 117758 accept # handle 274
|
||||||
|
oifname "br-b7976abb6e55" xt match "conntrack" counter packets 11952 bytes 824461 accept # handle 278
|
||||||
|
oifname "br-cfae917b997e" xt match "conntrack" counter packets 41 bytes 3861 accept # handle 285
|
||||||
|
oifname "br-f63e542ab28c" xt match "conntrack" counter packets 0 bytes 0 accept # handle 297
|
||||||
|
oifname "br-8b881e367322" xt match "conntrack" counter packets 168 bytes 419234 accept # handle 302
|
||||||
|
oifname "br-6caddd639b0b" xt match "conntrack" counter packets 0 bytes 0 accept # handle 308
|
||||||
|
oifname "br-2d50ca7a8f5d" xt match "conntrack" counter packets 0 bytes 0 accept # handle 313
|
||||||
|
oifname "br-dc41f9983a47" xt match "conntrack" counter packets 0 bytes 0 accept # handle 319
|
||||||
|
oifname "br-eeee48934935" xt match "conntrack" counter packets 61 bytes 204337 accept # handle 324
|
||||||
|
oifname "br-f10b040acc46" xt match "conntrack" counter packets 2177 bytes 4824454 accept # handle 329
|
||||||
|
oifname "br-87e08370adff" xt match "conntrack" counter packets 0 bytes 0 accept # handle 335
|
||||||
|
oifname "br-ed1bb1cc9d39" xt match "conntrack" counter packets 15 bytes 11675 accept # handle 343
|
||||||
|
oifname "br-527a7cd84ff6" xt match "conntrack" counter packets 4 bytes 207 accept # handle 348
|
||||||
|
oifname "br-03ee8c9e4bea" xt match "conntrack" counter packets 7597 bytes 18374987 accept # handle 355
|
||||||
|
oifname "br-f3f5c7cfa74e" xt match "conntrack" counter packets 664 bytes 703654 accept # handle 361
|
||||||
|
oifname "br-263c8508de6f" xt match "conntrack" counter packets 18991 bytes 2926748 accept # handle 370
|
||||||
|
oifname "br-fea0382ed10b" xt match "conntrack" counter packets 103 bytes 71274 accept # handle 375
|
||||||
|
oifname "br-f9343d8383ac" xt match "conntrack" counter packets 0 bytes 0 accept # handle 384
|
||||||
|
oifname "br-59ca07fbf200" xt match "conntrack" counter packets 0 bytes 0 accept # handle 389
|
||||||
|
oifname "br-051bbcfc21d8" xt match "conntrack" counter packets 0 bytes 0 accept # handle 394
|
||||||
|
oifname "br-4efe811b8402" xt match "conntrack" counter packets 0 bytes 0 accept # handle 400
|
||||||
|
oifname "br-bca9ecea74f1" xt match "conntrack" counter packets 0 bytes 0 accept # handle 405
|
||||||
|
oifname "br-a35cbfd37253" xt match "conntrack" counter packets 0 bytes 0 accept # handle 411
|
||||||
|
oifname "br-71bcae37092b" xt match "conntrack" counter packets 0 bytes 0 accept # handle 416
|
||||||
|
oifname "br-c50ccbc5e464" xt match "conntrack" counter packets 424336 bytes 101769455 accept # handle 421
|
||||||
|
oifname "br-618855db6757" xt match "conntrack" counter packets 0 bytes 0 accept # handle 438
|
||||||
|
oifname "br-28584d053169" xt match "conntrack" counter packets 12 bytes 6743 accept # handle 444
|
||||||
|
oifname "br-4ecbee63f4b0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 449
|
||||||
|
oifname "br-8200b83f03e9" xt match "conntrack" counter packets 66 bytes 182937 accept # handle 456
|
||||||
|
oifname "br-9891a93b5e9c" xt match "conntrack" counter packets 7240 bytes 40405768 accept # handle 461
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-INTERNAL { # handle 8
|
||||||
|
ip saddr != 172.21.0.0/16 oifname "br-d89dcf384c2a" counter packets 0 bytes 0 drop # handle 288
|
||||||
|
ip daddr != 172.21.0.0/16 iifname "br-d89dcf384c2a" counter packets 0 bytes 0 drop # handle 287
|
||||||
|
ip saddr != 172.19.0.0/16 oifname "br-ecba5adea6ea" counter packets 0 bytes 0 drop # handle 281
|
||||||
|
ip daddr != 172.19.0.0/16 iifname "br-ecba5adea6ea" counter packets 0 bytes 0 drop # handle 280
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-USER { # handle 169
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# Warning: table ip6 filter is managed by iptables-nft, do not touch!
|
||||||
|
table ip6 filter { # handle 2
|
||||||
|
chain INPUT { # handle 1
|
||||||
|
type filter hook input priority filter; policy accept;
|
||||||
|
}
|
||||||
|
|
||||||
|
chain FORWARD { # handle 2
|
||||||
|
type filter hook forward priority filter; policy drop;
|
||||||
|
counter packets 1704 bytes 966686 jump DOCKER-USER # handle 86
|
||||||
|
counter packets 1704 bytes 966686 jump DOCKER-FORWARD # handle 9
|
||||||
|
}
|
||||||
|
|
||||||
|
chain OUTPUT { # handle 3
|
||||||
|
type filter hook output priority filter; policy accept;
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER { # handle 4
|
||||||
|
ip6 daddr fd00:9::2 iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 accept # handle 177
|
||||||
|
ip6 daddr fd00:17::2 iifname != "br-28584d053169" oifname "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 accept # handle 167
|
||||||
|
ip6 daddr fd00:1::6 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 accept # handle 162
|
||||||
|
ip6 daddr fd00:10::2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 443 counter packets 0 bytes 0 accept # handle 156
|
||||||
|
ip6 daddr fd00:10::2 iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" tcp dport 80 counter packets 0 bytes 0 accept # handle 155
|
||||||
|
ip6 daddr fd00:1::5 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 8080 counter packets 0 bytes 0 accept # handle 150
|
||||||
|
ip6 daddr fd00:1::3 iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" tcp dport 80 counter packets 0 bytes 0 accept # handle 144
|
||||||
|
ip6 daddr fd00:24::2 iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" tcp dport 8080 counter packets 0 bytes 0 accept # handle 143
|
||||||
|
ip6 daddr fd00:30::4 iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" tcp dport 80 counter packets 0 bytes 0 accept # handle 114
|
||||||
|
iifname != "br-5a9988b94efd" oifname "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 34
|
||||||
|
iifname != "br-9aea00f5a485" oifname "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 99
|
||||||
|
iifname != "br-f63e542ab28c" oifname "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 103
|
||||||
|
iifname != "br-8b881e367322" oifname "br-8b881e367322" counter packets 0 bytes 0 drop # handle 107
|
||||||
|
iifname != "br-dc41f9983a47" oifname "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 111
|
||||||
|
iifname != "br-f10b040acc46" oifname "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 116
|
||||||
|
iifname != "br-87e08370adff" oifname "br-87e08370adff" counter packets 0 bytes 0 drop # handle 120
|
||||||
|
iifname != "br-ed1bb1cc9d39" oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 124
|
||||||
|
iifname != "br-527a7cd84ff6" oifname "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 128
|
||||||
|
iifname != "br-f3f5c7cfa74e" oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 132
|
||||||
|
iifname != "br-263c8508de6f" oifname "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 136
|
||||||
|
iifname != "br-f9343d8383ac" oifname "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 140
|
||||||
|
iifname != "br-051bbcfc21d8" oifname "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 146
|
||||||
|
iifname != "br-bca9ecea74f1" oifname "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 152
|
||||||
|
iifname != "br-618855db6757" oifname "br-618855db6757" counter packets 0 bytes 0 drop # handle 158
|
||||||
|
iifname != "br-28584d053169" oifname "br-28584d053169" counter packets 0 bytes 0 drop # handle 164
|
||||||
|
iifname != "br-4ecbee63f4b0" oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 169
|
||||||
|
iifname != "br-8200b83f03e9" oifname "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 174
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-FORWARD { # handle 5
|
||||||
|
counter packets 1704 bytes 966686 jump DOCKER-CT # handle 12
|
||||||
|
counter packets 798 bytes 112527 jump DOCKER-INTERNAL # handle 11
|
||||||
|
counter packets 798 bytes 112527 jump DOCKER-BRIDGE # handle 10
|
||||||
|
iifname "br-5a9988b94efd" counter packets 27 bytes 5590 accept # handle 33
|
||||||
|
iifname "br-9aea00f5a485" counter packets 0 bytes 0 accept # handle 98
|
||||||
|
iifname "br-f63e542ab28c" counter packets 0 bytes 0 accept # handle 102
|
||||||
|
iifname "br-8b881e367322" counter packets 0 bytes 0 accept # handle 106
|
||||||
|
iifname "br-dc41f9983a47" counter packets 0 bytes 0 accept # handle 110
|
||||||
|
iifname "br-f10b040acc46" counter packets 0 bytes 0 accept # handle 115
|
||||||
|
iifname "br-87e08370adff" counter packets 0 bytes 0 accept # handle 119
|
||||||
|
iifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 accept # handle 123
|
||||||
|
iifname "br-527a7cd84ff6" counter packets 0 bytes 0 accept # handle 127
|
||||||
|
iifname "br-f3f5c7cfa74e" counter packets 544 bytes 83353 accept # handle 131
|
||||||
|
iifname "br-263c8508de6f" counter packets 44 bytes 5795 accept # handle 135
|
||||||
|
iifname "br-f9343d8383ac" counter packets 0 bytes 0 accept # handle 139
|
||||||
|
iifname "br-051bbcfc21d8" counter packets 0 bytes 0 accept # handle 145
|
||||||
|
iifname "br-bca9ecea74f1" counter packets 122 bytes 10531 accept # handle 151
|
||||||
|
iifname "br-618855db6757" counter packets 0 bytes 0 accept # handle 157
|
||||||
|
iifname "br-28584d053169" counter packets 0 bytes 0 accept # handle 163
|
||||||
|
iifname "br-4ecbee63f4b0" counter packets 0 bytes 0 accept # handle 168
|
||||||
|
iifname "br-8200b83f03e9" counter packets 0 bytes 0 accept # handle 173
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-BRIDGE { # handle 6
|
||||||
|
oifname "br-5a9988b94efd" counter packets 0 bytes 0 jump DOCKER # handle 36
|
||||||
|
oifname "br-9aea00f5a485" counter packets 0 bytes 0 jump DOCKER # handle 101
|
||||||
|
oifname "br-f63e542ab28c" counter packets 0 bytes 0 jump DOCKER # handle 105
|
||||||
|
oifname "br-8b881e367322" counter packets 0 bytes 0 jump DOCKER # handle 109
|
||||||
|
oifname "br-dc41f9983a47" counter packets 0 bytes 0 jump DOCKER # handle 113
|
||||||
|
oifname "br-f10b040acc46" counter packets 0 bytes 0 jump DOCKER # handle 118
|
||||||
|
oifname "br-87e08370adff" counter packets 0 bytes 0 jump DOCKER # handle 122
|
||||||
|
oifname "br-ed1bb1cc9d39" counter packets 0 bytes 0 jump DOCKER # handle 126
|
||||||
|
oifname "br-527a7cd84ff6" counter packets 0 bytes 0 jump DOCKER # handle 130
|
||||||
|
oifname "br-f3f5c7cfa74e" counter packets 0 bytes 0 jump DOCKER # handle 134
|
||||||
|
oifname "br-263c8508de6f" counter packets 0 bytes 0 jump DOCKER # handle 138
|
||||||
|
oifname "br-f9343d8383ac" counter packets 0 bytes 0 jump DOCKER # handle 142
|
||||||
|
oifname "br-051bbcfc21d8" counter packets 0 bytes 0 jump DOCKER # handle 148
|
||||||
|
oifname "br-bca9ecea74f1" counter packets 0 bytes 0 jump DOCKER # handle 154
|
||||||
|
oifname "br-618855db6757" counter packets 0 bytes 0 jump DOCKER # handle 160
|
||||||
|
oifname "br-28584d053169" counter packets 0 bytes 0 jump DOCKER # handle 166
|
||||||
|
oifname "br-4ecbee63f4b0" counter packets 0 bytes 0 jump DOCKER # handle 171
|
||||||
|
oifname "br-8200b83f03e9" counter packets 0 bytes 0 jump DOCKER # handle 176
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-CT { # handle 7
|
||||||
|
oifname "br-5a9988b94efd" xt match "conntrack" counter packets 28 bytes 16684 accept # handle 35
|
||||||
|
oifname "br-9aea00f5a485" xt match "conntrack" counter packets 0 bytes 0 accept # handle 100
|
||||||
|
oifname "br-f63e542ab28c" xt match "conntrack" counter packets 0 bytes 0 accept # handle 104
|
||||||
|
oifname "br-8b881e367322" xt match "conntrack" counter packets 0 bytes 0 accept # handle 108
|
||||||
|
oifname "br-dc41f9983a47" xt match "conntrack" counter packets 0 bytes 0 accept # handle 112
|
||||||
|
oifname "br-f10b040acc46" xt match "conntrack" counter packets 0 bytes 0 accept # handle 117
|
||||||
|
oifname "br-87e08370adff" xt match "conntrack" counter packets 0 bytes 0 accept # handle 121
|
||||||
|
oifname "br-ed1bb1cc9d39" xt match "conntrack" counter packets 0 bytes 0 accept # handle 125
|
||||||
|
oifname "br-527a7cd84ff6" xt match "conntrack" counter packets 0 bytes 0 accept # handle 129
|
||||||
|
oifname "br-f3f5c7cfa74e" xt match "conntrack" counter packets 576 bytes 474421 accept # handle 133
|
||||||
|
oifname "br-263c8508de6f" xt match "conntrack" counter packets 38 bytes 15719 accept # handle 137
|
||||||
|
oifname "br-f9343d8383ac" xt match "conntrack" counter packets 0 bytes 0 accept # handle 141
|
||||||
|
oifname "br-051bbcfc21d8" xt match "conntrack" counter packets 0 bytes 0 accept # handle 147
|
||||||
|
oifname "br-bca9ecea74f1" xt match "conntrack" counter packets 225 bytes 333045 accept # handle 153
|
||||||
|
oifname "br-618855db6757" xt match "conntrack" counter packets 0 bytes 0 accept # handle 159
|
||||||
|
oifname "br-28584d053169" xt match "conntrack" counter packets 0 bytes 0 accept # handle 165
|
||||||
|
oifname "br-4ecbee63f4b0" xt match "conntrack" counter packets 0 bytes 0 accept # handle 170
|
||||||
|
oifname "br-8200b83f03e9" xt match "conntrack" counter packets 0 bytes 0 accept # handle 175
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-INTERNAL { # handle 8
|
||||||
|
}
|
||||||
|
|
||||||
|
chain DOCKER-USER { # handle 85
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# Warning: table ip nat is managed by iptables-nft, do not touch!
|
||||||
|
table ip nat { # handle 3
|
||||||
|
chain DOCKER { # handle 1
|
||||||
|
ip daddr 127.0.0.1 iifname != "docker0" tcp dport 3307 counter packets 0 bytes 0 xt target "DNAT" # handle 49
|
||||||
|
ip daddr 127.0.0.1 iifname != "docker0" tcp dport 5434 counter packets 0 bytes 0 xt target "DNAT" # handle 55
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-11ceaf8736f5" tcp dport 3005 counter packets 0 bytes 0 xt target "DNAT" # handle 72
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-11ceaf8736f5" tcp dport 7001 counter packets 0 bytes 0 xt target "DNAT" # handle 80
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-9aea00f5a485" tcp dport 8440 counter packets 0 bytes 0 xt target "DNAT" # handle 141
|
||||||
|
ip daddr 10.98.0.2 iifname != "br-b7976abb6e55" tcp dport 25 counter packets 500 bytes 29920 xt target "DNAT" # handle 145
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-b7976abb6e55" tcp dport 8088 counter packets 0 bytes 0 xt target "DNAT" # handle 146
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-b7976abb6e55" tcp dport 8443 counter packets 0 bytes 0 xt target "DNAT" # handle 147
|
||||||
|
ip daddr 10.98.0.2 iifname != "br-b7976abb6e55" tcp dport 465 counter packets 23 bytes 1252 xt target "DNAT" # handle 148
|
||||||
|
ip daddr 10.98.0.2 iifname != "br-b7976abb6e55" tcp dport 993 counter packets 33 bytes 1948 xt target "DNAT" # handle 149
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-f63e542ab28c" tcp dport 8017 counter packets 0 bytes 0 xt target "DNAT" # handle 151
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-6caddd639b0b" tcp dport 8765 counter packets 0 bytes 0 xt target "DNAT" # handle 156
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-2d50ca7a8f5d" tcp dport 1935 counter packets 0 bytes 0 xt target "DNAT" # handle 158
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-2d50ca7a8f5d" tcp dport 8086 counter packets 0 bytes 0 xt target "DNAT" # handle 159
|
||||||
|
iifname != "br-dc41f9983a47" tcp dport 9098 counter packets 0 bytes 0 xt target "DNAT" # handle 161
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-eeee48934935" tcp dport 7576 counter packets 0 bytes 0 xt target "DNAT" # handle 163
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-f10b040acc46" tcp dport 3000 counter packets 0 bytes 0 xt target "DNAT" # handle 166
|
||||||
|
ip daddr 10.98.0.2 iifname != "br-87e08370adff" tcp dport 2244 counter packets 0 bytes 0 xt target "DNAT" # handle 171
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-87e08370adff" tcp dport 2244 counter packets 0 bytes 0 xt target "DNAT" # handle 172
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-87e08370adff" tcp dport 3006 counter packets 0 bytes 0 xt target "DNAT" # handle 173
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-ed1bb1cc9d39" tcp dport 8181 counter packets 0 bytes 0 xt target "DNAT" # handle 175
|
||||||
|
ip daddr 10.98.0.2 iifname != "br-527a7cd84ff6" tcp dport 6667 counter packets 0 bytes 0 xt target "DNAT" # handle 177
|
||||||
|
ip daddr 10.98.0.2 iifname != "br-527a7cd84ff6" tcp dport 6697 counter packets 1 bytes 52 xt target "DNAT" # handle 178
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-527a7cd84ff6" tcp dport 8097 counter packets 0 bytes 0 xt target "DNAT" # handle 179
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-03ee8c9e4bea" tcp dport 1236 counter packets 0 bytes 0 xt target "DNAT" # handle 181
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-03ee8c9e4bea" tcp dport 8536 counter packets 0 bytes 0 xt target "DNAT" # handle 182
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-f3f5c7cfa74e" tcp dport 9201 counter packets 0 bytes 0 xt target "DNAT" # handle 184
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-f3f5c7cfa74e" tcp dport 3001 counter packets 0 bytes 0 xt target "DNAT" # handle 187
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-f3f5c7cfa74e" tcp dport 4001 counter packets 0 bytes 0 xt target "DNAT" # handle 188
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-263c8508de6f" tcp dport 6167 counter packets 0 bytes 0 xt target "DNAT" # handle 190
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 5280 counter packets 0 bytes 0 xt target "DNAT" # handle 192
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 8002 counter packets 0 bytes 0 xt target "DNAT" # handle 193
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 9090 counter packets 0 bytes 0 xt target "DNAT" # handle 194
|
||||||
|
iifname != "br-fea0382ed10b" udp dport 10009 counter packets 0 bytes 0 xt target "DNAT" # handle 195
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-fea0382ed10b" tcp dport 8001 counter packets 0 bytes 0 xt target "DNAT" # handle 196
|
||||||
|
iifname != "br-f9343d8383ac" tcp dport 8383 counter packets 0 bytes 0 xt target "DNAT" # handle 198
|
||||||
|
iifname != "br-5a9988b94efd" tcp dport 7778 counter packets 0 bytes 0 xt target "DNAT" # handle 200
|
||||||
|
iifname != "br-5a9988b94efd" tcp dport 8016 counter packets 0 bytes 0 xt target "DNAT" # handle 203
|
||||||
|
iifname != "br-e02b7c89a2d3" tcp dport 9009 counter packets 0 bytes 0 xt target "DNAT" # handle 205
|
||||||
|
iifname != "br-bca9ecea74f1" tcp dport 8090 counter packets 0 bytes 0 xt target "DNAT" # handle 207
|
||||||
|
iifname != "br-bca9ecea74f1" tcp dport 444 counter packets 0 bytes 0 xt target "DNAT" # handle 208
|
||||||
|
iifname != "br-a35cbfd37253" tcp dport 8000 counter packets 0 bytes 0 xt target "DNAT" # handle 210
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-71bcae37092b" tcp dport 7676 counter packets 0 bytes 0 xt target "DNAT" # handle 212
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 5000 counter packets 0 bytes 0 xt target "DNAT" # handle 214
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 5055 counter packets 0 bytes 0 xt target "DNAT" # handle 215
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 5075 counter packets 0 bytes 0 xt target "DNAT" # handle 216
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 6767 counter packets 0 bytes 0 xt target "DNAT" # handle 217
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 7878 counter packets 0 bytes 0 xt target "DNAT" # handle 218
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 8080 counter packets 0 bytes 0 xt target "DNAT" # handle 219
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 8191 counter packets 0 bytes 0 xt target "DNAT" # handle 220
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 8265 counter packets 0 bytes 0 xt target "DNAT" # handle 221
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 8787 counter packets 0 bytes 0 xt target "DNAT" # handle 222
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 8888 counter packets 0 bytes 0 xt target "DNAT" # handle 223
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 8989 counter packets 0 bytes 0 xt target "DNAT" # handle 224
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 9696 counter packets 0 bytes 0 xt target "DNAT" # handle 225
|
||||||
|
iifname != "br-c50ccbc5e464" tcp dport 5030 counter packets 0 bytes 0 xt target "DNAT" # handle 226
|
||||||
|
iifname != "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 xt target "DNAT" # handle 229
|
||||||
|
iifname != "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 xt target "DNAT" # handle 231
|
||||||
|
iifname != "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 xt target "DNAT" # handle 237
|
||||||
|
ip daddr 127.0.0.1 iifname != "br-9891a93b5e9c" tcp dport 8945 counter packets 0 bytes 0 xt target "DNAT" # handle 239
|
||||||
|
}
|
||||||
|
|
||||||
|
chain PREROUTING { # handle 2
|
||||||
|
type nat hook prerouting priority dstnat; policy accept;
|
||||||
|
xt match "addrtype" counter packets 12868 bytes 773053 jump DOCKER # handle 3
|
||||||
|
}
|
||||||
|
|
||||||
|
chain OUTPUT { # handle 4
|
||||||
|
type nat hook output priority dstnat; policy accept;
|
||||||
|
ip daddr != 127.0.0.0/8 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER # handle 5
|
||||||
|
}
|
||||||
|
|
||||||
|
chain POSTROUTING { # handle 6
|
||||||
|
type nat hook postrouting priority srcnat; policy accept;
|
||||||
|
ip saddr 172.31.0.0/16 oifname != "br-9891a93b5e9c" counter packets 3 bytes 180 xt target "MASQUERADE" # handle 238
|
||||||
|
ip saddr 10.9.0.0/16 oifname != "br-8200b83f03e9" counter packets 2 bytes 120 xt target "MASQUERADE" # handle 236
|
||||||
|
ip saddr 10.18.0.0/16 oifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 232
|
||||||
|
ip saddr 10.17.0.0/16 oifname != "br-28584d053169" counter packets 1 bytes 60 xt target "MASQUERADE" # handle 230
|
||||||
|
ip saddr 10.16.0.0/16 oifname != "br-618855db6757" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 227
|
||||||
|
ip saddr 10.19.0.0/16 oifname != "br-c50ccbc5e464" counter packets 4 bytes 378 xt target "MASQUERADE" # handle 213
|
||||||
|
ip saddr 172.30.0.0/16 oifname != "br-71bcae37092b" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 211
|
||||||
|
ip saddr 10.13.0.0/16 oifname != "br-a35cbfd37253" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 209
|
||||||
|
ip saddr 10.10.0.0/16 oifname != "br-bca9ecea74f1" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 206
|
||||||
|
ip saddr 172.27.0.0/16 oifname != "br-4efe811b8402" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 204
|
||||||
|
ip saddr 10.41.0.0/16 oifname != "br-051bbcfc21d8" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 201
|
||||||
|
ip saddr 10.32.0.0/16 oifname != "br-59ca07fbf200" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 199
|
||||||
|
ip saddr 10.24.0.0/16 oifname != "br-f9343d8383ac" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 197
|
||||||
|
ip saddr 172.26.0.0/16 oifname != "br-fea0382ed10b" counter packets 12 bytes 3156 xt target "MASQUERADE" # handle 191
|
||||||
|
ip saddr 10.26.0.0/16 oifname != "br-263c8508de6f" counter packets 17780 bytes 1459511 xt target "MASQUERADE" # handle 189
|
||||||
|
ip saddr 10.31.0.0/16 oifname != "br-f3f5c7cfa74e" counter packets 87 bytes 5220 xt target "MASQUERADE" # handle 183
|
||||||
|
ip saddr 172.28.0.0/16 oifname != "br-03ee8c9e4bea" counter packets 43 bytes 2580 xt target "MASQUERADE" # handle 180
|
||||||
|
ip saddr 10.20.0.0/16 oifname != "br-527a7cd84ff6" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 176
|
||||||
|
ip saddr 10.28.0.0/16 oifname != "br-ed1bb1cc9d39" counter packets 1 bytes 60 xt target "MASQUERADE" # handle 174
|
||||||
|
ip saddr 10.27.0.0/16 oifname != "br-87e08370adff" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 167
|
||||||
|
ip saddr 10.29.0.0/16 oifname != "br-f10b040acc46" counter packets 28 bytes 1680 xt target "MASQUERADE" # handle 164
|
||||||
|
ip saddr 172.24.0.0/16 oifname != "br-eeee48934935" counter packets 1 bytes 60 xt target "MASQUERADE" # handle 162
|
||||||
|
ip saddr 10.30.0.0/16 oifname != "br-dc41f9983a47" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 160
|
||||||
|
ip saddr 172.23.0.0/16 oifname != "br-2d50ca7a8f5d" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 157
|
||||||
|
ip saddr 172.22.0.0/16 oifname != "br-6caddd639b0b" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 155
|
||||||
|
ip saddr 10.40.0.0/16 oifname != "br-8b881e367322" counter packets 3 bytes 180 xt target "MASQUERADE" # handle 152
|
||||||
|
ip saddr 10.4.0.0/16 oifname != "br-f63e542ab28c" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 150
|
||||||
|
ip saddr 172.20.0.0/16 oifname != "br-cfae917b997e" counter packets 9 bytes 1092 xt target "MASQUERADE" # handle 144
|
||||||
|
ip saddr 172.18.0.0/16 oifname != "br-b7976abb6e55" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 143
|
||||||
|
ip saddr 10.2.0.0/16 oifname != "br-68e2ed0ec6ac" counter packets 492 bytes 40183 xt target "MASQUERADE" # handle 142
|
||||||
|
ip saddr 10.3.0.0/16 oifname != "br-9aea00f5a485" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 140
|
||||||
|
ip saddr 172.17.0.0/16 oifname != "docker0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 46
|
||||||
|
ip saddr 172.25.0.0/16 oifname != "br-875fced92cd0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 41
|
||||||
|
ip saddr 10.99.0.0/16 oifname != "br-e02b7c89a2d3" counter packets 4000 bytes 239992 xt target "MASQUERADE" # handle 37
|
||||||
|
ip saddr 10.1.0.0/16 oifname != "br-5a9988b94efd" counter packets 7 bytes 420 xt target "MASQUERADE" # handle 21
|
||||||
|
ip saddr 172.29.0.0/16 oifname != "br-dee363d4e0c6" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 10
|
||||||
|
ip saddr 10.55.0.0/16 oifname != "br-11ceaf8736f5" counter packets 10 bytes 600 xt target "MASQUERADE" # handle 8
|
||||||
|
}
|
||||||
|
}
|
||||||
|
# Warning: table ip6 nat is managed by iptables-nft, do not touch!
|
||||||
|
table ip6 nat { # handle 4
|
||||||
|
chain DOCKER { # handle 1
|
||||||
|
ip6 saddr != fe80::/10 iifname != "br-dc41f9983a47" tcp dport 9098 counter packets 0 bytes 0 xt target "DNAT" # handle 40
|
||||||
|
ip6 saddr != fe80::/10 iifname != "br-f9343d8383ac" tcp dport 8383 counter packets 0 bytes 0 xt target "DNAT" # handle 48
|
||||||
|
ip6 saddr != fe80::/10 iifname != "br-5a9988b94efd" tcp dport 7778 counter packets 0 bytes 0 xt target "DNAT" # handle 49
|
||||||
|
ip6 saddr != fe80::/10 iifname != "br-5a9988b94efd" tcp dport 8016 counter packets 0 bytes 0 xt target "DNAT" # handle 52
|
||||||
|
ip6 saddr != fe80::/10 iifname != "br-bca9ecea74f1" tcp dport 8090 counter packets 0 bytes 0 xt target "DNAT" # handle 54
|
||||||
|
ip6 saddr != fe80::/10 iifname != "br-bca9ecea74f1" tcp dport 444 counter packets 0 bytes 0 xt target "DNAT" # handle 55
|
||||||
|
ip6 saddr != fe80::/10 iifname != "br-5a9988b94efd" tcp dport 4533 counter packets 0 bytes 0 xt target "DNAT" # handle 58
|
||||||
|
ip6 saddr != fe80::/10 iifname != "br-28584d053169" tcp dport 9980 counter packets 0 bytes 0 xt target "DNAT" # handle 60
|
||||||
|
ip6 saddr != fe80::/10 iifname != "br-8200b83f03e9" tcp dport 8096 counter packets 0 bytes 0 xt target "DNAT" # handle 64
|
||||||
|
}
|
||||||
|
|
||||||
|
chain PREROUTING { # handle 2
|
||||||
|
type nat hook prerouting priority dstnat; policy accept;
|
||||||
|
xt match "addrtype" counter packets 2 bytes 112 jump DOCKER # handle 3
|
||||||
|
}
|
||||||
|
|
||||||
|
chain OUTPUT { # handle 4
|
||||||
|
type nat hook output priority dstnat; policy accept;
|
||||||
|
ip6 daddr != ::1 xt match "addrtype" counter packets 0 bytes 0 jump DOCKER # handle 5
|
||||||
|
}
|
||||||
|
|
||||||
|
chain POSTROUTING { # handle 6
|
||||||
|
type nat hook postrouting priority srcnat; policy accept;
|
||||||
|
ip6 saddr fd00:9::/64 oifname != "br-8200b83f03e9" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 63
|
||||||
|
ip6 saddr fd00:18::/64 oifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 61
|
||||||
|
ip6 saddr fd00:17::/64 oifname != "br-28584d053169" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 59
|
||||||
|
ip6 saddr fd00:16::/64 oifname != "br-618855db6757" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 56
|
||||||
|
ip6 saddr fd00:10::/64 oifname != "br-bca9ecea74f1" counter packets 1 bytes 80 xt target "MASQUERADE" # handle 53
|
||||||
|
ip6 saddr fd00:41::/64 oifname != "br-051bbcfc21d8" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 50
|
||||||
|
ip6 saddr fd00:24::/64 oifname != "br-f9343d8383ac" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 47
|
||||||
|
ip6 saddr fd00:26::/64 oifname != "br-263c8508de6f" counter packets 5 bytes 400 xt target "MASQUERADE" # handle 46
|
||||||
|
ip6 saddr fd00:31::/64 oifname != "br-f3f5c7cfa74e" counter packets 60 bytes 4800 xt target "MASQUERADE" # handle 45
|
||||||
|
ip6 saddr fd00:20::/64 oifname != "br-527a7cd84ff6" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 44
|
||||||
|
ip6 saddr fd00:28::/64 oifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 43
|
||||||
|
ip6 saddr fd00:27::/64 oifname != "br-87e08370adff" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 42
|
||||||
|
ip6 saddr fd00:29::/64 oifname != "br-f10b040acc46" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 41
|
||||||
|
ip6 saddr fd00:30::/64 oifname != "br-dc41f9983a47" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 39
|
||||||
|
ip6 saddr fd00:40::/64 oifname != "br-8b881e367322" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 38
|
||||||
|
ip6 saddr fd00:4::/64 oifname != "br-f63e542ab28c" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 37
|
||||||
|
ip6 saddr fd00:3::/64 oifname != "br-9aea00f5a485" counter packets 0 bytes 0 xt target "MASQUERADE" # handle 36
|
||||||
|
ip6 saddr fd00:1::/64 oifname != "br-5a9988b94efd" counter packets 2 bytes 160 xt target "MASQUERADE" # handle 12
|
||||||
|
}
|
||||||
|
}
|
||||||
|
table ip raw { # handle 5
|
||||||
|
chain PREROUTING { # handle 1
|
||||||
|
type filter hook prerouting priority raw; policy accept;
|
||||||
|
ip daddr 10.1.0.17 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 4
|
||||||
|
ip daddr 10.1.0.20 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 7
|
||||||
|
ip daddr 10.99.0.18 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 8
|
||||||
|
ip daddr 10.1.0.9 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 9
|
||||||
|
ip daddr 10.1.0.12 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 18
|
||||||
|
ip daddr 10.1.0.19 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 19
|
||||||
|
ip daddr 10.1.0.22 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 20
|
||||||
|
ip daddr 172.17.0.2 iifname != "docker0" counter packets 0 bytes 0 drop # handle 27
|
||||||
|
ip daddr 172.17.0.3 iifname != "docker0" counter packets 0 bytes 0 drop # handle 32
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3307 counter packets 0 bytes 0 drop # handle 39
|
||||||
|
ip daddr 172.17.0.4 iifname != "docker0" counter packets 0 bytes 0 drop # handle 48
|
||||||
|
ip daddr 10.55.0.2 iifname != "br-11ceaf8736f5" counter packets 0 bytes 0 drop # handle 53
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 5434 counter packets 0 bytes 0 drop # handle 66
|
||||||
|
ip daddr 10.55.0.3 iifname != "br-11ceaf8736f5" counter packets 0 bytes 0 drop # handle 85
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3005 counter packets 0 bytes 0 drop # handle 104
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 7001 counter packets 0 bytes 0 drop # handle 118
|
||||||
|
ip daddr 10.99.0.2 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 251
|
||||||
|
ip daddr 10.99.0.3 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 252
|
||||||
|
ip daddr 10.3.0.2 iifname != "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 253
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8440 counter packets 0 bytes 0 drop # handle 254
|
||||||
|
ip daddr 172.18.0.2 iifname != "br-b7976abb6e55" counter packets 0 bytes 0 drop # handle 255
|
||||||
|
ip daddr 172.20.0.2 iifname != "br-cfae917b997e" counter packets 0 bytes 0 drop # handle 256
|
||||||
|
ip daddr 10.2.255.254 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 257
|
||||||
|
ip daddr 10.2.0.2 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 258
|
||||||
|
ip daddr 172.18.0.3 iifname != "br-b7976abb6e55" counter packets 0 bytes 0 drop # handle 259
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8088 counter packets 0 bytes 0 drop # handle 260
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8443 counter packets 0 bytes 0 drop # handle 261
|
||||||
|
ip daddr 10.2.0.3 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 262
|
||||||
|
ip daddr 10.2.0.4 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 263
|
||||||
|
ip daddr 172.20.0.3 iifname != "br-cfae917b997e" counter packets 0 bytes 0 drop # handle 264
|
||||||
|
ip daddr 10.2.0.5 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 265
|
||||||
|
ip daddr 10.2.0.6 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 266
|
||||||
|
ip daddr 10.2.0.7 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 267
|
||||||
|
ip daddr 10.2.0.8 iifname != "br-68e2ed0ec6ac" counter packets 0 bytes 0 drop # handle 268
|
||||||
|
ip daddr 10.4.0.2 iifname != "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 269
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8017 counter packets 0 bytes 0 drop # handle 270
|
||||||
|
ip daddr 172.22.0.2 iifname != "br-6caddd639b0b" counter packets 0 bytes 0 drop # handle 275
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8765 counter packets 0 bytes 0 drop # handle 276
|
||||||
|
ip daddr 172.23.0.2 iifname != "br-2d50ca7a8f5d" counter packets 0 bytes 0 drop # handle 277
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 1935 counter packets 0 bytes 0 drop # handle 278
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8086 counter packets 0 bytes 0 drop # handle 279
|
||||||
|
ip daddr 10.30.0.2 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 280
|
||||||
|
ip daddr 10.30.0.3 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 281
|
||||||
|
ip daddr 10.1.0.2 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 282
|
||||||
|
ip daddr 10.99.0.5 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 283
|
||||||
|
ip daddr 10.30.0.4 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 284
|
||||||
|
ip daddr 172.24.0.2 iifname != "br-eeee48934935" counter packets 0 bytes 0 drop # handle 285
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 7576 counter packets 0 bytes 0 drop # handle 286
|
||||||
|
ip daddr 10.29.0.2 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 287
|
||||||
|
ip daddr 10.99.0.6 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 288
|
||||||
|
ip daddr 10.29.0.3 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 290
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3000 counter packets 0 bytes 0 drop # handle 291
|
||||||
|
ip daddr 10.99.0.7 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 292
|
||||||
|
ip daddr 10.27.0.2 iifname != "br-87e08370adff" counter packets 0 bytes 0 drop # handle 295
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 2244 counter packets 0 bytes 0 drop # handle 296
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3006 counter packets 0 bytes 0 drop # handle 297
|
||||||
|
ip daddr 10.28.0.2 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 298
|
||||||
|
ip daddr 10.28.0.3 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 299
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8181 counter packets 0 bytes 0 drop # handle 300
|
||||||
|
ip daddr 10.99.0.8 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 301
|
||||||
|
ip daddr 10.20.0.2 iifname != "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 302
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8097 counter packets 0 bytes 0 drop # handle 303
|
||||||
|
ip daddr 172.28.0.2 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 304
|
||||||
|
ip daddr 10.99.0.9 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 305
|
||||||
|
ip daddr 172.28.0.3 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 306
|
||||||
|
ip daddr 172.28.0.4 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 307
|
||||||
|
ip daddr 172.28.0.5 iifname != "br-03ee8c9e4bea" counter packets 0 bytes 0 drop # handle 308
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 1236 counter packets 0 bytes 0 drop # handle 309
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8536 counter packets 0 bytes 0 drop # handle 310
|
||||||
|
ip daddr 10.31.0.2 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 311
|
||||||
|
ip daddr 10.31.0.3 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 312
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 9201 counter packets 0 bytes 0 drop # handle 313
|
||||||
|
ip daddr 10.99.0.10 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 314
|
||||||
|
ip daddr 10.99.0.11 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 315
|
||||||
|
ip daddr 10.99.0.12 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 316
|
||||||
|
ip daddr 10.31.0.4 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 319
|
||||||
|
ip daddr 10.31.0.5 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 320
|
||||||
|
ip daddr 10.31.0.6 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 321
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 3001 counter packets 0 bytes 0 drop # handle 322
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 4001 counter packets 0 bytes 0 drop # handle 323
|
||||||
|
ip daddr 10.26.0.2 iifname != "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 324
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 6167 counter packets 0 bytes 0 drop # handle 325
|
||||||
|
ip daddr 172.26.0.2 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 326
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 5280 counter packets 0 bytes 0 drop # handle 327
|
||||||
|
ip daddr 172.26.0.3 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 328
|
||||||
|
ip daddr 172.26.0.4 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 329
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8002 counter packets 0 bytes 0 drop # handle 330
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 9090 counter packets 0 bytes 0 drop # handle 331
|
||||||
|
ip daddr 172.26.0.5 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 332
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8001 counter packets 0 bytes 0 drop # handle 333
|
||||||
|
ip daddr 172.26.0.6 iifname != "br-fea0382ed10b" counter packets 0 bytes 0 drop # handle 334
|
||||||
|
ip daddr 10.24.0.2 iifname != "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 335
|
||||||
|
ip daddr 10.32.0.2 iifname != "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 336
|
||||||
|
ip daddr 10.1.0.3 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 337
|
||||||
|
ip daddr 10.1.0.4 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 338
|
||||||
|
ip daddr 10.99.0.13 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 339
|
||||||
|
ip daddr 10.99.0.14 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 340
|
||||||
|
ip daddr 10.32.0.3 iifname != "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 341
|
||||||
|
ip daddr 10.32.0.4 iifname != "br-59ca07fbf200" counter packets 0 bytes 0 drop # handle 342
|
||||||
|
ip daddr 10.41.0.2 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 343
|
||||||
|
ip daddr 10.41.0.3 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 344
|
||||||
|
ip daddr 10.1.0.5 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 345
|
||||||
|
ip daddr 10.99.0.15 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 346
|
||||||
|
ip daddr 172.27.0.2 iifname != "br-4efe811b8402" counter packets 0 bytes 0 drop # handle 347
|
||||||
|
ip daddr 10.99.0.16 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 348
|
||||||
|
ip daddr 172.27.0.3 iifname != "br-4efe811b8402" counter packets 0 bytes 0 drop # handle 349
|
||||||
|
ip daddr 10.10.0.2 iifname != "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 350
|
||||||
|
ip daddr 10.13.0.2 iifname != "br-a35cbfd37253" counter packets 0 bytes 0 drop # handle 351
|
||||||
|
ip daddr 172.30.0.2 iifname != "br-71bcae37092b" counter packets 0 bytes 0 drop # handle 352
|
||||||
|
ip daddr 172.30.0.3 iifname != "br-71bcae37092b" counter packets 0 bytes 0 drop # handle 355
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 7676 counter packets 0 bytes 0 drop # handle 356
|
||||||
|
ip daddr 10.19.0.2 iifname != "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 357
|
||||||
|
ip daddr 10.19.0.3 iifname != "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 358
|
||||||
|
ip daddr 10.19.0.4 iifname != "br-c50ccbc5e464" counter packets 0 bytes 0 drop # handle 359
|
||||||
|
ip daddr 10.16.0.2 iifname != "br-618855db6757" counter packets 0 bytes 0 drop # handle 360
|
||||||
|
ip daddr 10.1.0.6 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 361
|
||||||
|
ip daddr 10.99.0.17 iifname != "br-e02b7c89a2d3" counter packets 0 bytes 0 drop # handle 362
|
||||||
|
ip daddr 10.17.0.2 iifname != "br-28584d053169" counter packets 0 bytes 0 drop # handle 363
|
||||||
|
ip daddr 10.18.0.2 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 366
|
||||||
|
ip daddr 10.18.0.3 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 367
|
||||||
|
ip daddr 10.18.0.4 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 368
|
||||||
|
ip daddr 10.9.0.2 iifname != "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 370
|
||||||
|
ip daddr 172.31.0.2 iifname != "br-9891a93b5e9c" counter packets 0 bytes 0 drop # handle 371
|
||||||
|
ip daddr 127.0.0.1 iifname != "lo" tcp dport 8945 counter packets 0 bytes 0 drop # handle 372
|
||||||
|
}
|
||||||
|
}
|
||||||
|
table ip6 raw { # handle 6
|
||||||
|
chain PREROUTING { # handle 1
|
||||||
|
type filter hook prerouting priority raw; policy accept;
|
||||||
|
ip6 daddr fd00:1::11 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 3
|
||||||
|
ip6 daddr fd00:1::14 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 4
|
||||||
|
ip6 daddr fd00:1::9 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 5
|
||||||
|
ip6 daddr fd00:1::c iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 7
|
||||||
|
ip6 daddr fd00:1::13 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 8
|
||||||
|
ip6 daddr fd00:1::16 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 9
|
||||||
|
ip6 daddr fd00:3::2 iifname != "br-9aea00f5a485" counter packets 0 bytes 0 drop # handle 38
|
||||||
|
ip6 daddr fd00:4::2 iifname != "br-f63e542ab28c" counter packets 0 bytes 0 drop # handle 39
|
||||||
|
ip6 daddr fd00:30::2 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 41
|
||||||
|
ip6 daddr fd00:30::3 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 42
|
||||||
|
ip6 daddr fd00:1::2 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 43
|
||||||
|
ip6 daddr fd00:30::4 iifname != "br-dc41f9983a47" counter packets 0 bytes 0 drop # handle 44
|
||||||
|
ip6 daddr fd00:29::2 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 45
|
||||||
|
ip6 daddr fd00:29::3 iifname != "br-f10b040acc46" counter packets 0 bytes 0 drop # handle 46
|
||||||
|
ip6 daddr fd00:27::2 iifname != "br-87e08370adff" counter packets 0 bytes 0 drop # handle 47
|
||||||
|
ip6 daddr fd00:28::2 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 48
|
||||||
|
ip6 daddr fd00:28::3 iifname != "br-ed1bb1cc9d39" counter packets 0 bytes 0 drop # handle 49
|
||||||
|
ip6 daddr fd00:20::2 iifname != "br-527a7cd84ff6" counter packets 0 bytes 0 drop # handle 50
|
||||||
|
ip6 daddr fd00:31::2 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 51
|
||||||
|
ip6 daddr fd00:31::3 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 52
|
||||||
|
ip6 daddr fd00:31::4 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 53
|
||||||
|
ip6 daddr fd00:31::5 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 54
|
||||||
|
ip6 daddr fd00:31::6 iifname != "br-f3f5c7cfa74e" counter packets 0 bytes 0 drop # handle 55
|
||||||
|
ip6 daddr fd00:26::2 iifname != "br-263c8508de6f" counter packets 0 bytes 0 drop # handle 56
|
||||||
|
ip6 daddr fd00:24::2 iifname != "br-f9343d8383ac" counter packets 0 bytes 0 drop # handle 57
|
||||||
|
ip6 daddr fd00:1::3 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 58
|
||||||
|
ip6 daddr fd00:1::4 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 59
|
||||||
|
ip6 daddr fd00:41::2 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 60
|
||||||
|
ip6 daddr fd00:41::3 iifname != "br-051bbcfc21d8" counter packets 0 bytes 0 drop # handle 61
|
||||||
|
ip6 daddr fd00:1::5 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 62
|
||||||
|
ip6 daddr fd00:10::2 iifname != "br-bca9ecea74f1" counter packets 0 bytes 0 drop # handle 63
|
||||||
|
ip6 daddr fd00:16::2 iifname != "br-618855db6757" counter packets 0 bytes 0 drop # handle 64
|
||||||
|
ip6 daddr fd00:1::6 iifname != "br-5a9988b94efd" counter packets 0 bytes 0 drop # handle 65
|
||||||
|
ip6 daddr fd00:17::2 iifname != "br-28584d053169" counter packets 0 bytes 0 drop # handle 66
|
||||||
|
ip6 daddr fd00:18::2 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 67
|
||||||
|
ip6 daddr fd00:18::3 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 68
|
||||||
|
ip6 daddr fd00:18::4 iifname != "br-4ecbee63f4b0" counter packets 0 bytes 0 drop # handle 69
|
||||||
|
ip6 daddr fd00:9::2 iifname != "br-8200b83f03e9" counter packets 0 bytes 0 drop # handle 71
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,21 @@
|
||||||
|
2026-07-12T20:24:21-04:00
|
||||||
|
TITANSERVER
|
||||||
|
Linux TITANSERVER 7.1.3-zen1-2-zen #1 ZEN SMP PREEMPT_DYNAMIC Thu, 09 Jul 2026 20:39:38 +0000 x86_64 GNU/Linux
|
||||||
|
|
||||||
|
=== user@1200 ===
|
||||||
|
LoadState=loaded
|
||||||
|
ActiveState=inactive
|
||||||
|
SubState=dead
|
||||||
|
FragmentPath=/usr/lib/systemd/system/user@.service
|
||||||
|
DropInPaths=/usr/lib/systemd/system/user@.service.d/10-login-barrier.conf
|
||||||
|
Result=success
|
||||||
|
|
||||||
|
=== linger ===
|
||||||
|
linger=absent
|
||||||
|
|
||||||
|
=== UID 1200 processes ===
|
||||||
|
none
|
||||||
|
|
||||||
|
=== runtime directory/socket ===
|
||||||
|
stat: cannot statx '/run/user/1200': No such file or directory
|
||||||
|
stat: cannot statx '/run/user/1200/docker.sock': No such file or directory
|
||||||
|
|
@ -0,0 +1,41 @@
|
||||||
|
docker 1:29.6.1-1
|
||||||
|
containerd 2.3.2-1
|
||||||
|
docker-compose 5.3.1-1
|
||||||
|
rootlesskit 3.0.1-1
|
||||||
|
slirp4netns 1.3.4-1
|
||||||
|
libslirp 4.9.3-1
|
||||||
|
openai-codex 0.144.1-2
|
||||||
|
Client:
|
||||||
|
Version: 29.6.1
|
||||||
|
API version: 1.55
|
||||||
|
Go version: go1.26.4-X:nodwarf5
|
||||||
|
Git commit: 8900f1d330
|
||||||
|
Built: Sun Jun 28 16:44:00 2026
|
||||||
|
OS/Arch: linux/amd64
|
||||||
|
Context: default
|
||||||
|
|
||||||
|
Server:
|
||||||
|
Engine:
|
||||||
|
Version: 29.6.1
|
||||||
|
API version: 1.55 (minimum version 1.40)
|
||||||
|
Go version: go1.26.4-X:nodwarf5
|
||||||
|
Git commit: 8ec5ab355a
|
||||||
|
Built: Sun Jun 28 16:44:00 2026
|
||||||
|
OS/Arch: linux/amd64
|
||||||
|
Experimental: false
|
||||||
|
containerd:
|
||||||
|
Version: v2.3.2
|
||||||
|
GitCommit: fff62f14765df376e5fc36f5a8f8e795b5670f61.m
|
||||||
|
nvidia:
|
||||||
|
Version: 1.5.0
|
||||||
|
GitCommit:
|
||||||
|
docker-init:
|
||||||
|
Version: 0.19.0
|
||||||
|
GitCommit: de40ad0
|
||||||
|
rootlesskit version 3.0.1
|
||||||
|
slirp4netns version 1.3.4
|
||||||
|
commit: unknown
|
||||||
|
libslirp: 4.9.3
|
||||||
|
SLIRP_CONFIG_VERSION_MAX: 6
|
||||||
|
libseccomp: 2.6.0
|
||||||
|
codex-cli 0.144.1
|
||||||
|
|
@ -0,0 +1,32 @@
|
||||||
|
user::rwx
|
||||||
|
group::r-x
|
||||||
|
other::---
|
||||||
|
|
||||||
|
user::rwx
|
||||||
|
group::---
|
||||||
|
other::---
|
||||||
|
|
||||||
|
user::rwx
|
||||||
|
group::---
|
||||||
|
other::---
|
||||||
|
|
||||||
|
user::r-x
|
||||||
|
group::r-x
|
||||||
|
other::---
|
||||||
|
|
||||||
|
user::rwx
|
||||||
|
group::r-x
|
||||||
|
other::---
|
||||||
|
|
||||||
|
user::rwx
|
||||||
|
group::---
|
||||||
|
other::---
|
||||||
|
|
||||||
|
user::rwx
|
||||||
|
group::---
|
||||||
|
other::---
|
||||||
|
|
||||||
|
user::rwx
|
||||||
|
group::---
|
||||||
|
other::---
|
||||||
|
|
||||||
|
|
@ -0,0 +1,8 @@
|
||||||
|
/srv/le-app-codex|uid=0|gid=1200|mode=750|type=d
|
||||||
|
/srv/le-app-codex/home|uid=1200|gid=1200|mode=700|type=d
|
||||||
|
/srv/le-app-codex/lasereverything.net.db|uid=1200|gid=1200|mode=700|type=d
|
||||||
|
/srv/le-app-codex/database-source-readonly|uid=0|gid=1200|mode=550|type=d
|
||||||
|
/srv/le-app-codex/nonproduction-secrets|uid=0|gid=1200|mode=750|type=d
|
||||||
|
/srv/le-app-codex/container-runtime|uid=1200|gid=1200|mode=700|type=d
|
||||||
|
/srv/le-app-codex/testing-data|uid=1200|gid=1200|mode=700|type=d
|
||||||
|
/srv/le-app-codex/build-artifacts|uid=1200|gid=1200|mode=700|type=d
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
# Phase 2B IPv4-only public DNS; no LAN resolver exception.
|
||||||
|
nameserver 9.9.9.9
|
||||||
|
nameserver 149.112.112.112
|
||||||
|
options edns0 trust-ad
|
||||||
|
|
@ -0,0 +1,54 @@
|
||||||
|
table inet le_app_codex {
|
||||||
|
set approved_dns4 {
|
||||||
|
type ipv4_addr
|
||||||
|
flags interval
|
||||||
|
elements = { 9.9.9.9, 149.112.112.112 }
|
||||||
|
}
|
||||||
|
|
||||||
|
set operator_host_public4 {
|
||||||
|
type ipv4_addr
|
||||||
|
flags interval
|
||||||
|
elements = { 74.67.173.56 }
|
||||||
|
}
|
||||||
|
|
||||||
|
set denied4 {
|
||||||
|
type ipv4_addr
|
||||||
|
flags interval
|
||||||
|
elements = {
|
||||||
|
0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8,
|
||||||
|
169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24,
|
||||||
|
192.0.2.0/24, 192.88.99.0/24, 192.168.0.0/16,
|
||||||
|
198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24,
|
||||||
|
224.0.0.0/4, 240.0.0.0/4
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
chain input {
|
||||||
|
type filter hook input priority filter; policy accept;
|
||||||
|
iifname "lecodex-host" ct state established,related accept
|
||||||
|
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
|
||||||
|
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
|
||||||
|
iifname "lecodex-host" counter drop
|
||||||
|
}
|
||||||
|
|
||||||
|
chain forward {
|
||||||
|
type filter hook forward priority filter; policy accept;
|
||||||
|
oifname "lecodex-host" ct state established,related accept
|
||||||
|
oifname "lecodex-host" counter drop
|
||||||
|
iifname "lecodex-host" ip daddr @approved_dns4 udp dport 53 accept
|
||||||
|
iifname "lecodex-host" ip daddr @approved_dns4 tcp dport 53 accept
|
||||||
|
iifname "lecodex-host" ip daddr @operator_host_public4 counter drop
|
||||||
|
iifname "lecodex-host" ip daddr @denied4 counter drop
|
||||||
|
iifname "lecodex-host" meta nfproto ipv6 counter drop
|
||||||
|
iifname "lecodex-host" tcp dport { 25, 465, 587 } counter drop
|
||||||
|
iifname "lecodex-host" tcp dport { 80, 443 } accept
|
||||||
|
iifname "lecodex-host" counter drop
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
table ip le_app_codex_nat {
|
||||||
|
chain postrouting {
|
||||||
|
type nat hook postrouting priority srcnat; policy accept;
|
||||||
|
ip saddr 10.200.120.0/30 oifname != "lecodex-host" masquerade
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,11 @@
|
||||||
|
[Unit]
|
||||||
|
Description=Root-owned IPv4-only namespace for le_app_codex
|
||||||
|
Before=user@1200.service
|
||||||
|
ConditionPathExists=/etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
RemainAfterExit=yes
|
||||||
|
ExecStart=/usr/local/libexec/le-app-codex-netns up
|
||||||
|
ExecStop=/usr/local/libexec/le-app-codex-netns down
|
||||||
|
|
||||||
|
|
@ -0,0 +1,7 @@
|
||||||
|
[Slice]
|
||||||
|
CPUQuota=600%
|
||||||
|
MemoryHigh=48G
|
||||||
|
MemoryMax=64G
|
||||||
|
MemorySwapMax=16G
|
||||||
|
TasksMax=4096
|
||||||
|
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
[Unit]
|
||||||
|
Requires=le-app-codex-netns.service
|
||||||
|
After=le-app-codex-netns.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
NetworkNamespacePath=/run/netns/le-app-codex
|
||||||
|
ProtectSystem=strict
|
||||||
|
PrivateTmp=yes
|
||||||
|
ProtectHome=yes
|
||||||
|
ProtectProc=invisible
|
||||||
|
ProcSubset=all
|
||||||
|
BindReadOnlyPaths=/etc/le-app-codex-runtime/resolv.conf:/etc/resolv.conf
|
||||||
|
TemporaryFileSystem=/srv:ro
|
||||||
|
BindPaths=/srv/le-app-codex:/srv/le-app-codex
|
||||||
|
TemporaryFileSystem=/var:ro
|
||||||
|
TemporaryFileSystem=/mnt:ro
|
||||||
|
TemporaryFileSystem=/media:ro
|
||||||
|
TemporaryFileSystem=/opt:ro
|
||||||
|
InaccessiblePaths=/var/www
|
||||||
|
InaccessiblePaths=/root
|
||||||
|
InaccessiblePaths=/home
|
||||||
|
InaccessiblePaths=/boot
|
||||||
|
InaccessiblePaths=/efi
|
||||||
|
InaccessiblePaths=/run/docker.sock
|
||||||
|
InaccessiblePaths=/var/run/docker.sock
|
||||||
|
InaccessiblePaths=/run/containerd/containerd.sock
|
||||||
|
InaccessiblePaths=/run/podman
|
||||||
|
InaccessiblePaths=/run/dbus/system_bus_socket
|
||||||
|
InaccessiblePaths=/run/systemd/private
|
||||||
|
InaccessiblePaths=/var/lib/docker
|
||||||
|
InaccessiblePaths=/var/lib/containerd
|
||||||
|
InaccessiblePaths=/var/lib/containers
|
||||||
|
InaccessiblePaths=/etc/docker
|
||||||
|
InaccessiblePaths=/etc/containers
|
||||||
|
InaccessiblePaths=/etc/ssh
|
||||||
|
InaccessiblePaths=/etc/NetworkManager/system-connections
|
||||||
|
InaccessiblePaths=/etc/wireguard
|
||||||
|
DevicePolicy=closed
|
||||||
|
DeviceAllow=/dev/fuse rw
|
||||||
|
DeviceAllow=/dev/net/tun rw
|
||||||
|
|
@ -0,0 +1,16 @@
|
||||||
|
{
|
||||||
|
"data-root": "/srv/le-app-codex/container-runtime/docker",
|
||||||
|
"storage-driver": "fuse-overlayfs",
|
||||||
|
"live-restore": false,
|
||||||
|
"userland-proxy": false,
|
||||||
|
"ipv6": false,
|
||||||
|
"ip6tables": false,
|
||||||
|
"iptables": true,
|
||||||
|
"hosts": ["unix:///run/user/1200/docker.sock"],
|
||||||
|
"log-driver": "local",
|
||||||
|
"log-opts": {
|
||||||
|
"max-size": "20m",
|
||||||
|
"max-file": "5"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,34 @@
|
||||||
|
[Unit]
|
||||||
|
Description=Laser Everything rootless Docker
|
||||||
|
Documentation=https://docs.docker.com/engine/security/rootless/
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=notify
|
||||||
|
NotifyAccess=all
|
||||||
|
KillMode=mixed
|
||||||
|
Environment=HOME=/srv/le-app-codex/home
|
||||||
|
Environment=XDG_RUNTIME_DIR=/run/user/1200
|
||||||
|
Environment=DOCKER_HOST=unix:///run/user/1200/docker.sock
|
||||||
|
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=/run/user/1200/dockerd-rootless
|
||||||
|
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns
|
||||||
|
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=builtin
|
||||||
|
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520
|
||||||
|
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX=true
|
||||||
|
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=true
|
||||||
|
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK=true
|
||||||
|
Environment=DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS=false
|
||||||
|
ExecStart=/usr/local/libexec/dockerd-rootless-29.6.1.sh
|
||||||
|
ExecReload=/usr/bin/kill -s HUP $MAINPID
|
||||||
|
Restart=always
|
||||||
|
RestartSec=2
|
||||||
|
TimeoutStartSec=0
|
||||||
|
TimeoutStopSec=120
|
||||||
|
LimitNOFILE=infinity
|
||||||
|
LimitNPROC=infinity
|
||||||
|
LimitCORE=infinity
|
||||||
|
TasksMax=infinity
|
||||||
|
Delegate=yes
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=default.target
|
||||||
|
|
||||||
|
|
@ -0,0 +1,4 @@
|
||||||
|
{
|
||||||
|
"currentContext": "le-app-codex"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
@ -0,0 +1,10 @@
|
||||||
|
{
|
||||||
|
"Name": "le-app-codex",
|
||||||
|
"Metadata": {},
|
||||||
|
"Endpoints": {
|
||||||
|
"docker": {
|
||||||
|
"Host": "unix:///run/user/1200/docker.sock",
|
||||||
|
"SkipTLSVerify": false
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
@ -0,0 +1,255 @@
|
||||||
|
#!/bin/sh
|
||||||
|
# dockerd-rootless.sh executes dockerd in rootless mode.
|
||||||
|
#
|
||||||
|
# Usage: dockerd-rootless.sh [DOCKERD_OPTIONS]
|
||||||
|
#
|
||||||
|
# External dependencies:
|
||||||
|
# * newuidmap and newgidmap needs to be installed.
|
||||||
|
# * /etc/subuid and /etc/subgid needs to be configured for the current user.
|
||||||
|
#
|
||||||
|
# Recognized environment variables:
|
||||||
|
# * DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR=DIR: the rootlesskit state dir.
|
||||||
|
# * Defaults to "$XDG_RUNTIME_DIR/dockerd-rootless".
|
||||||
|
# * DOCKERD_ROOTLESS_ROOTLESSKIT_NET=(slirp4netns|vpnkit|pasta|gvisor-tap-vsock|lxc-user-nic): the rootlesskit network driver.
|
||||||
|
# * Defaults to "slirp4netns" if slirp4netns (>= v0.4.0) is installed, else "pasta", else "vpnkit", else "gvisor-tap-vsock".
|
||||||
|
# * DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=NUM: the MTU value for the rootlesskit network driver.
|
||||||
|
# * Defaults to 65520 for slirp4netns, pasta, and gvisor-tap-vsock. Defaults to 1500 for other rootlesskit network drivers.
|
||||||
|
# * DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=(builtin|slirp4netns|implicit|gvisor-tap-vsock): the rootlesskit port driver.
|
||||||
|
# * Defaults to "implicit" for "pasta", "builtin" for other rootlesskit network drivers.
|
||||||
|
# * DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX=(auto|true|false): whether to protect slirp4netns with a dedicated mount namespace.
|
||||||
|
# * Defaults to "auto".
|
||||||
|
# * DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP=(auto|true|false): whether to protect slirp4netns with seccomp.
|
||||||
|
# * Defaults to "auto".
|
||||||
|
# * DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK=(true|false): prohibit connections to 127.0.0.1 on the host (including via 10.0.2.2, in the case of slirp4netns).
|
||||||
|
# * Defaults to "true".
|
||||||
|
# * DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS=(true|false): whether to launch rootlesskit with the "detach-netns" mode.
|
||||||
|
# The "detached-netns" mode accelerates `docker (pull|push|build)` and enables `docker run --net=host`
|
||||||
|
# Defaults to "true". Set this to false only when facing a compatibility issue.
|
||||||
|
|
||||||
|
# To apply an environment variable via systemd, create ~/.config/systemd/user/docker.service.d/override.conf as follows,
|
||||||
|
# and run `systemctl --user daemon-reload && systemctl --user restart docker`:
|
||||||
|
# --- BEGIN ---
|
||||||
|
# [Service]
|
||||||
|
# Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_NET=pasta"
|
||||||
|
# Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=implicit"
|
||||||
|
# --- END ---
|
||||||
|
|
||||||
|
# Guide to choose the network driver and the port driver:
|
||||||
|
#
|
||||||
|
# Network driver | Port driver | Net throughput | Port throughput | Src IP | No SUID | Note
|
||||||
|
# -----------------|------------------|----------------|-----------------|--------|---------|---------------------------------------------------------
|
||||||
|
# gvisor-tap-vsock | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Default when slirp4netns is not installed
|
||||||
|
# slirp4netns | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Default when slirp4netns is installed
|
||||||
|
# vpnkit | builtin | Slow | Fast ✅ | ✅ (*) | ✅ | Legacy
|
||||||
|
# gvisor-tap-vsock | gvisor-tap-vsock | Slow | Slow | ❌ | ✅ | Not recommended. Use `builtin` port driver instead.
|
||||||
|
# slirp4netns | slirp4netns | Slow | Slow | ✅ | ✅ |
|
||||||
|
# pasta | implicit | Slow | Fast ✅ | ✅ | ✅ | Experimental; Needs recent version of pasta (2023_12_04)
|
||||||
|
# lxc-user-nic | builtin | Fast ✅ | Fast ✅ | ✅ (*) | ❌ | Experimental
|
||||||
|
# (bypass4netns) | (bypass4netns) | Fast ✅ | Fast ✅ | ✅ | ✅ | (Not integrated to RootlessKit)
|
||||||
|
#
|
||||||
|
# (*) Applicable since RootlessKit v3.0. Also requires userland-proxy to be disabled.
|
||||||
|
|
||||||
|
# See the documentation for the further information: https://docs.docker.com/go/rootless/
|
||||||
|
|
||||||
|
set -e -x
|
||||||
|
case "$1" in
|
||||||
|
"check" | "install" | "uninstall")
|
||||||
|
echo "Did you mean 'dockerd-rootless-setuptool.sh $@' ?"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
if ! [ -w "$XDG_RUNTIME_DIR" ]; then
|
||||||
|
echo "XDG_RUNTIME_DIR needs to be set and writable"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if ! [ -d "$HOME" ]; then
|
||||||
|
echo "HOME needs to be set and exist."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
mount_directory() {
|
||||||
|
if [ -z "$_DOCKERD_ROOTLESS_CHILD" ]; then
|
||||||
|
echo "mount_directory should be called from the child context. Otherwise data loss is at risk" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
DIRECTORY="$1"
|
||||||
|
if [ ! -d "$DIRECTORY" ]; then
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Bind mount directory: this makes this directory visible to
|
||||||
|
# Dockerd, even if it is originally a symlink, given Dockerd does
|
||||||
|
# not always follow symlinks. Some directories might also be
|
||||||
|
# "copied-up", meaning that they will also be writable on the child
|
||||||
|
# namespace; this will be the case only if they are provided as
|
||||||
|
# --copy-up to the rootlesskit.
|
||||||
|
DIRECTORY_REALPATH=$(realpath "$DIRECTORY")
|
||||||
|
MOUNT_OPTIONS="${2:---bind}"
|
||||||
|
rm -rf "$DIRECTORY"
|
||||||
|
mkdir -p "$DIRECTORY"
|
||||||
|
mount $MOUNT_OPTIONS "$DIRECTORY_REALPATH" "$DIRECTORY"
|
||||||
|
}
|
||||||
|
|
||||||
|
rootlesskit=""
|
||||||
|
for f in docker-rootlesskit rootlesskit; do
|
||||||
|
if command -v $f > /dev/null 2>&1; then
|
||||||
|
rootlesskit=$f
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
if [ -z "$rootlesskit" ]; then
|
||||||
|
echo "rootlesskit needs to be installed"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
: "${CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR:=$XDG_RUNTIME_DIR/containerd-rootless}"
|
||||||
|
if [ -e "$CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR" ]; then
|
||||||
|
# https://github.com/moby/moby/issues/52171
|
||||||
|
echo "dockerd-rootless.sh conflicts with containerd-rootless.sh. Stop containerd-rootless.sh if it's running, and remove $CONTAINERD_ROOTLESS_ROOTLESSKIT_STATE_DIR if it still exists."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR:=$XDG_RUNTIME_DIR/dockerd-rootless}"
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_NET:=}"
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_MTU:=}"
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER:=}"
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX:=auto}"
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP:=auto}"
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK:=}"
|
||||||
|
: "${DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS:=true}"
|
||||||
|
net=$DOCKERD_ROOTLESS_ROOTLESSKIT_NET
|
||||||
|
port_driver=$DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER
|
||||||
|
mtu=$DOCKERD_ROOTLESS_ROOTLESSKIT_MTU
|
||||||
|
if [ -z "$net" ]; then
|
||||||
|
if command -v slirp4netns > /dev/null 2>&1; then
|
||||||
|
# If --netns-type is present in --help, slirp4netns is >= v0.4.0.
|
||||||
|
if slirp4netns --help | grep -qw -- --netns-type; then
|
||||||
|
net=slirp4netns
|
||||||
|
else
|
||||||
|
echo "slirp4netns found but seems older than v0.4.0. Checking for other network drivers."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [ -z "$net" ]; then
|
||||||
|
if command -v pasta > /dev/null 2>&1; then
|
||||||
|
net=pasta
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [ -z "$net" ]; then
|
||||||
|
if command -v vpnkit > /dev/null 2>&1; then
|
||||||
|
net=vpnkit
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [ -z "$net" ]; then
|
||||||
|
net=gvisor-tap-vsock
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
if [ "$net" = host ]; then
|
||||||
|
echo "Unsupported RootlessKit network driver: $net"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
if [ -z "$mtu" ]; then
|
||||||
|
case "$net" in
|
||||||
|
slirp4netns | pasta | gvisor-tap-vsock)
|
||||||
|
mtu=65520
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
mtu=1500
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
if [ -z "$port_driver" ]; then
|
||||||
|
if [ "$net" = pasta ]; then
|
||||||
|
port_driver=implicit
|
||||||
|
else
|
||||||
|
port_driver=builtin
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
host_loopback="--disable-host-loopback"
|
||||||
|
if [ "$DOCKERD_ROOTLESS_ROOTLESSKIT_DISABLE_HOST_LOOPBACK" = "false" ]; then
|
||||||
|
host_loopback=""
|
||||||
|
fi
|
||||||
|
|
||||||
|
dockerd="${DOCKERD:-dockerd}"
|
||||||
|
|
||||||
|
if [ -z "$_DOCKERD_ROOTLESS_CHILD" ]; then
|
||||||
|
_DOCKERD_ROOTLESS_CHILD=1
|
||||||
|
export _DOCKERD_ROOTLESS_CHILD
|
||||||
|
if [ "$(id -u)" = "0" ]; then
|
||||||
|
echo "This script must be executed as a non-privileged user"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
# `selinuxenabled` always returns false in RootlessKit child, so we execute `selinuxenabled` in the parent.
|
||||||
|
# https://github.com/rootless-containers/rootlesskit/issues/94
|
||||||
|
if command -v selinuxenabled > /dev/null 2>&1 && selinuxenabled; then
|
||||||
|
_DOCKERD_ROOTLESS_SELINUX=1
|
||||||
|
export _DOCKERD_ROOTLESS_SELINUX
|
||||||
|
fi
|
||||||
|
|
||||||
|
case "$DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS" in
|
||||||
|
1 | true)
|
||||||
|
DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS="--detach-netns $DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS"
|
||||||
|
;;
|
||||||
|
0 | false)
|
||||||
|
# NOP
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Unknown DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS value: $DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS"
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
# Re-exec the script via RootlessKit, so as to create unprivileged {user,mount,network} namespaces.
|
||||||
|
#
|
||||||
|
# --copy-up allows removing/creating files in the directories by creating tmpfs and symlinks
|
||||||
|
# * /etc: copy-up is required so as to prevent `/etc/resolv.conf` in the
|
||||||
|
# namespace from being unexpectedly unmounted when `/etc/resolv.conf` is recreated on the host
|
||||||
|
# (by either systemd-networkd or NetworkManager)
|
||||||
|
# * /run: copy-up is required so that we can create /run/docker (hardcoded for plugins) in our namespace
|
||||||
|
exec $rootlesskit \
|
||||||
|
--state-dir=$DOCKERD_ROOTLESS_ROOTLESSKIT_STATE_DIR \
|
||||||
|
--net=$net --mtu=$mtu \
|
||||||
|
--slirp4netns-sandbox=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SANDBOX \
|
||||||
|
--slirp4netns-seccomp=$DOCKERD_ROOTLESS_ROOTLESSKIT_SLIRP4NETNS_SECCOMP \
|
||||||
|
$host_loopback --port-driver=$port_driver \
|
||||||
|
--copy-up=/etc --copy-up=/run \
|
||||||
|
--propagation=rslave \
|
||||||
|
$DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS \
|
||||||
|
"$0" "$@"
|
||||||
|
else
|
||||||
|
[ "$_DOCKERD_ROOTLESS_CHILD" = 1 ]
|
||||||
|
|
||||||
|
# remove the symlinks for the existing files in the parent namespace if any,
|
||||||
|
# so that we can create our own files in our mount namespace.
|
||||||
|
rm -f /run/docker /run/containerd /run/xtables.lock
|
||||||
|
|
||||||
|
if [ -n "$_DOCKERD_ROOTLESS_SELINUX" ]; then
|
||||||
|
# iptables requires /run in the child to be relabeled. The actual /run in the parent is unaffected.
|
||||||
|
# https://github.com/containers/podman/blob/e6fc34b71aa9d876b1218efe90e14f8b912b0603/libpod/networking_linux.go#L396-L401
|
||||||
|
# https://github.com/moby/moby/issues/41230
|
||||||
|
chcon system_u:object_r:iptables_var_run_t:s0 /run
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "$(stat -c %T -f /etc)" = "tmpfs" ] && [ -L "/etc/ssl" ]; then
|
||||||
|
# Workaround for "x509: certificate signed by unknown authority" on openSUSE Tumbleweed.
|
||||||
|
# https://github.com/rootless-containers/rootlesskit/issues/225
|
||||||
|
mount_directory /etc/ssl "--rbind"
|
||||||
|
fi
|
||||||
|
|
||||||
|
netns="/proc/self/ns/net"
|
||||||
|
case "$DOCKERD_ROOTLESS_ROOTLESSKIT_DETACH_NETNS" in
|
||||||
|
1 | true)
|
||||||
|
netns="$ROOTLESSKIT_STATE_DIR/netns"
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
# When running with --firewall-backend=nftables, IP forwarding needs to be enabled
|
||||||
|
# because the daemon won't enable it. IP forwarding is harmless in the rootless
|
||||||
|
# netns, there's only a single external interface and only Docker uses the netns.
|
||||||
|
# So, always enable IPv4 and IPv6 forwarding. But ignore failure to enable IPv6
|
||||||
|
# forwarding, for hosts with IPv6 disabled.
|
||||||
|
nsenter -n"$netns" sysctl -w net.ipv4.ip_forward=1
|
||||||
|
nsenter -n"$netns" sysctl -w net.ipv6.conf.all.forwarding=1 || true
|
||||||
|
|
||||||
|
exec "$dockerd" "$@"
|
||||||
|
fi
|
||||||
|
|
@ -0,0 +1,40 @@
|
||||||
|
#!/bin/sh
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
NS=le-app-codex
|
||||||
|
HOST_IF=lecodex-host
|
||||||
|
NS_IF=lecodex-ns
|
||||||
|
|
||||||
|
down() {
|
||||||
|
/usr/bin/nft delete table inet le_app_codex 2>/dev/null || true
|
||||||
|
/usr/bin/nft delete table ip le_app_codex_nat 2>/dev/null || true
|
||||||
|
/usr/bin/ip link delete "$HOST_IF" 2>/dev/null || true
|
||||||
|
/usr/bin/ip netns delete "$NS" 2>/dev/null || true
|
||||||
|
}
|
||||||
|
|
||||||
|
case "${1:-}" in
|
||||||
|
up)
|
||||||
|
test "$(id -u)" -eq 0
|
||||||
|
test -r /etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
|
||||||
|
/usr/bin/grep -q 'elements = { 9\.9\.9\.9, 149\.112\.112\.112 }' /etc/nftables.d/50-le-app-codex.nft
|
||||||
|
/usr/bin/grep -q 'elements = { 74\.67\.173\.56 }' /etc/nftables.d/50-le-app-codex.nft
|
||||||
|
test ! -e /run/netns/$NS
|
||||||
|
! /usr/bin/nft list table inet le_app_codex >/dev/null 2>&1
|
||||||
|
! /usr/bin/nft list table ip le_app_codex_nat >/dev/null 2>&1
|
||||||
|
trap down EXIT HUP INT TERM
|
||||||
|
/usr/bin/ip netns add "$NS"
|
||||||
|
/usr/bin/ip link add "$HOST_IF" type veth peer name "$NS_IF"
|
||||||
|
/usr/bin/ip link set "$NS_IF" netns "$NS"
|
||||||
|
/usr/bin/ip address add 10.200.120.1/30 dev "$HOST_IF"
|
||||||
|
/usr/bin/ip link set "$HOST_IF" up
|
||||||
|
/usr/bin/ip -n "$NS" link set lo up
|
||||||
|
/usr/bin/ip -n "$NS" address add 10.200.120.2/30 dev "$NS_IF"
|
||||||
|
/usr/bin/ip -n "$NS" link set "$NS_IF" up
|
||||||
|
/usr/bin/ip -n "$NS" route add default via 10.200.120.1 dev "$NS_IF"
|
||||||
|
/usr/bin/ip netns exec "$NS" /usr/bin/sysctl -q -w net.ipv6.conf.all.disable_ipv6=1 net.ipv6.conf.default.disable_ipv6=1
|
||||||
|
/usr/bin/nft -f /etc/nftables.d/50-le-app-codex.nft
|
||||||
|
trap - EXIT HUP INT TERM
|
||||||
|
;;
|
||||||
|
down) down ;;
|
||||||
|
*) echo 'usage: le-app-codex-netns up|down' >&2; exit 64 ;;
|
||||||
|
esac
|
||||||
|
|
@ -0,0 +1,28 @@
|
||||||
|
#!/bin/sh
|
||||||
|
set -eu
|
||||||
|
test "$(id -u)" -eq 0
|
||||||
|
test "$(docker version --format '{{.Server.Version}}')" = 29.6.1
|
||||||
|
test "$(sha256sum payload/usr/local/libexec/dockerd-rootless-29.6.1.sh | cut -d' ' -f1)" = 904c9b9e35f6927c0a5e65afb4d35b6bc9eb1278c878044501281fc728c9be46
|
||||||
|
test ! -S /run/user/1200/docker.sock
|
||||||
|
test "$(systemctl show user@1200.service -p ActiveState --value)" = inactive
|
||||||
|
test ! -e /var/lib/systemd/linger/le_app_codex
|
||||||
|
test -z "$(pgrep -u 1200 || true)"
|
||||||
|
test ! -e /run/netns/le-app-codex
|
||||||
|
test ! -e /etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
|
||||||
|
test ! -e /etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
|
||||||
|
docker network inspect $(docker network ls -q) --format '{{.Name}} {{range .IPAM.Config}}{{.Subnet}} {{end}}'
|
||||||
|
ip -brief address
|
||||||
|
ip -4 route show table all
|
||||||
|
ip -6 route show table all
|
||||||
|
sed -n '1,120p' /etc/resolv.conf
|
||||||
|
nft --numeric list ruleset
|
||||||
|
systemctl cat user@1200.service
|
||||||
|
loginctl show-user 1200 || true
|
||||||
|
namei -om /srv/le-app-codex
|
||||||
|
find /srv/le-app-codex -xdev -printf '%M %u:%g %p\n'
|
||||||
|
getfacl -R -p /srv/le-app-codex
|
||||||
|
findmnt -R /srv/le-app-codex
|
||||||
|
grep -q 'elements = { 9\.9\.9\.9, 149\.112\.112\.112 }' payload/etc/nftables.d/50-le-app-codex.nft
|
||||||
|
grep -q 'elements = { 74\.67\.173\.56 }' payload/etc/nftables.d/50-le-app-codex.nft
|
||||||
|
grep -q '^nameserver 9\.9\.9\.9$' payload/etc/le-app-codex-runtime/resolv.conf
|
||||||
|
grep -q '^nameserver 149\.112\.112\.112$' payload/etc/le-app-codex-runtime/resolv.conf
|
||||||
|
|
@ -0,0 +1,101 @@
|
||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
failures=0
|
||||||
|
artifact_root=$(CDPATH= cd -- "$(dirname -- "$0")/.." 2>/dev/null && pwd)
|
||||||
|
|
||||||
|
pass() { printf 'PASS: %s\n' "$1"; }
|
||||||
|
fail() { printf 'FAIL: %s\n' "$1" >&2; failures=$((failures + 1)); }
|
||||||
|
run_check() {
|
||||||
|
label=$1
|
||||||
|
shift
|
||||||
|
if "$@"; then pass "$label"; else fail "$label"; fi
|
||||||
|
}
|
||||||
|
expect_stat() {
|
||||||
|
path=$1 expected=$2
|
||||||
|
actual=$(/usr/bin/stat -c '%u:%g:%a:%F' "$path" 2>/dev/null)
|
||||||
|
if [ "$actual" = "$expected" ]; then pass "$path ownership/mode"; else fail "$path expected $expected, got ${actual:-missing}"; fi
|
||||||
|
}
|
||||||
|
expect_absent() {
|
||||||
|
path=$1
|
||||||
|
if [ ! -e "$path" ] && [ ! -L "$path" ]; then pass "$path absent"; else fail "$path must not already exist"; fi
|
||||||
|
}
|
||||||
|
|
||||||
|
if [ "$(id -u)" = 0 ]; then pass 'running as root'; else fail 'must be run as root'; fi
|
||||||
|
if [ -n "$artifact_root" ] && [ -d "$artifact_root/payload" ]; then pass 'artifact root resolved'; else fail 'artifact root not found'; fi
|
||||||
|
|
||||||
|
if (cd "$artifact_root" && /usr/bin/sha256sum -c MANIFEST.sha256); then pass 'complete artifact manifest'; else fail 'complete artifact manifest'; fi
|
||||||
|
if (cd "$artifact_root/inventory" && /usr/bin/sha256sum -c SHA256SUMS); then pass 'original root inventory'; else fail 'original root inventory'; fi
|
||||||
|
|
||||||
|
run_check 'staged nftables syntax' /usr/bin/nft --check -f "$artifact_root/payload/etc/nftables.d/50-le-app-codex.nft"
|
||||||
|
|
||||||
|
system_unit_path="$artifact_root/payload/etc/systemd/system:/etc/systemd/system:/run/systemd/system:/usr/local/lib/systemd/system:/usr/lib/systemd/system"
|
||||||
|
systemd_output=$(SYSTEMD_UNIT_PATH="$system_unit_path" /usr/bin/systemd-analyze verify --recursive-errors=no user@1200.service user-1200.slice le-app-codex-netns.service 2>&1)
|
||||||
|
systemd_rc=$?
|
||||||
|
printf '%s\n' "$systemd_output"
|
||||||
|
systemd_unexpected=$(printf '%s\n' "$systemd_output" | /usr/bin/sed -e '\#le-app-codex-netns.service: Command /usr/local/libexec/le-app-codex-netns is not executable: No such file or directory#d')
|
||||||
|
if [ "$systemd_rc" -eq 0 ] || [ -z "$systemd_unexpected" ]; then pass 'staged system units/drop-ins via host search path'; else fail 'staged system units/drop-ins via host search path'; fi
|
||||||
|
|
||||||
|
user_unit_path="$artifact_root/payload/srv/le-app-codex/home/.config/systemd/user:/etc/systemd/user:/run/systemd/user:/usr/local/lib/systemd/user:/usr/lib/systemd/user"
|
||||||
|
user_systemd_output=$(SYSTEMD_UNIT_PATH="$user_unit_path" /usr/bin/systemd-analyze verify --recursive-errors=no docker.service 2>&1)
|
||||||
|
user_systemd_rc=$?
|
||||||
|
printf '%s\n' "$user_systemd_output"
|
||||||
|
user_systemd_unexpected=$(printf '%s\n' "$user_systemd_output" | /usr/bin/sed -e '\#docker.service: Command /usr/local/libexec/dockerd-rootless-29.6.1.sh is not executable: No such file or directory#d')
|
||||||
|
if [ "$user_systemd_rc" -eq 0 ] || [ -z "$user_systemd_unexpected" ]; then pass 'staged Docker user unit via host search path'; else fail 'staged Docker user unit via host search path'; fi
|
||||||
|
|
||||||
|
shell_failures=0
|
||||||
|
for file in "$artifact_root"/tests/*.sh "$artifact_root"/payload/usr/local/libexec/*; do
|
||||||
|
/bin/sh -n "$file" || shell_failures=$((shell_failures + 1))
|
||||||
|
done
|
||||||
|
if [ "$shell_failures" -eq 0 ]; then pass 'shell syntax'; else fail 'shell syntax'; fi
|
||||||
|
|
||||||
|
json_failures=0
|
||||||
|
for file in "$artifact_root"/payload/srv/le-app-codex/home/.config/docker/daemon.json \
|
||||||
|
"$artifact_root"/payload/srv/le-app-codex/home/.docker/config.json \
|
||||||
|
"$artifact_root"/payload/srv/le-app-codex/home/.docker/contexts/meta/1b645e55bd6af77d420732b143423e7a27b12fbb5a71497e5d89c52481b6a535/meta.json \
|
||||||
|
"$artifact_root"/inventory/docker-networks.json; do
|
||||||
|
/usr/bin/jq empty "$file" || json_failures=$((json_failures + 1))
|
||||||
|
done
|
||||||
|
if [ "$json_failures" -eq 0 ]; then pass 'JSON syntax'; else fail 'JSON syntax'; fi
|
||||||
|
|
||||||
|
expect_stat /srv/le-app-codex '0:1200:750:directory'
|
||||||
|
expect_stat /srv/le-app-codex/home '1200:1200:700:directory'
|
||||||
|
expect_stat /srv/le-app-codex/lasereverything.net.db '1200:1200:700:directory'
|
||||||
|
expect_stat /srv/le-app-codex/database-source-readonly '0:1200:550:directory'
|
||||||
|
expect_stat /srv/le-app-codex/nonproduction-secrets '0:1200:750:directory'
|
||||||
|
expect_stat /srv/le-app-codex/container-runtime '1200:1200:700:directory'
|
||||||
|
expect_stat /srv/le-app-codex/testing-data '1200:1200:700:directory'
|
||||||
|
expect_stat /srv/le-app-codex/build-artifacts '1200:1200:700:directory'
|
||||||
|
|
||||||
|
project_mounts=$(/usr/bin/findmnt -rn -o TARGET | /usr/bin/awk '$0 == "/srv/le-app-codex" || index($0, "/srv/le-app-codex/") == 1 { print }')
|
||||||
|
if [ -z "$project_mounts" ]; then pass 'no project-rooted mounts'; else fail "unexpected project-rooted mounts: $project_mounts"; fi
|
||||||
|
|
||||||
|
expect_absent /etc/le-app-codex-runtime/OPERATOR-INPUTS-APPROVED
|
||||||
|
expect_absent /etc/le-app-codex-runtime/resolv.conf
|
||||||
|
expect_absent /etc/nftables.d/50-le-app-codex.nft
|
||||||
|
expect_absent /etc/systemd/system/le-app-codex-netns.service
|
||||||
|
expect_absent /etc/systemd/system/user-1200.slice.d/50-le-app-codex-resources.conf
|
||||||
|
expect_absent /etc/systemd/system/user@1200.service.d/50-le-app-codex-containment.conf
|
||||||
|
expect_absent /usr/local/libexec/dockerd-rootless-29.6.1.sh
|
||||||
|
expect_absent /usr/local/libexec/le-app-codex-netns
|
||||||
|
expect_absent /srv/le-app-codex/home/.config/systemd/user/docker.service
|
||||||
|
expect_absent /srv/le-app-codex/home/.config/docker/daemon.json
|
||||||
|
expect_absent /srv/le-app-codex/home/.docker/config.json
|
||||||
|
expect_absent /srv/le-app-codex/home/.docker/contexts/meta/1b645e55bd6af77d420732b143423e7a27b12fbb5a71497e5d89c52481b6a535/meta.json
|
||||||
|
expect_absent /srv/le-app-codex/phase2b-tests/00-root-preinstall-validate.sh
|
||||||
|
expect_absent /srv/le-app-codex/phase2b-tests/00-read-only-preflight.sh
|
||||||
|
expect_absent /srv/le-app-codex/phase2b-tests/10-inert-containment.sh
|
||||||
|
expect_absent /srv/le-app-codex/phase2b-tests/20-rootless-docker.sh
|
||||||
|
expect_absent /srv/le-app-codex/phase2b-tests/run-inert-without-user-manager.sh
|
||||||
|
|
||||||
|
active_state=$(/usr/bin/systemctl show user@1200.service -p ActiveState --value 2>/dev/null)
|
||||||
|
if [ "$active_state" = inactive ]; then pass 'user@1200.service inactive'; else fail "user@1200.service state is ${active_state:-unknown}"; fi
|
||||||
|
if [ ! -e /var/lib/systemd/linger/le_app_codex ] && [ ! -e /var/lib/systemd/linger/1200 ]; then pass 'linger absent'; else fail 'linger present'; fi
|
||||||
|
uid_processes=$(/usr/bin/pgrep -u 1200 2>/dev/null)
|
||||||
|
if [ -z "$uid_processes" ]; then pass 'UID 1200 has no processes'; else fail "UID 1200 processes found: $uid_processes"; fi
|
||||||
|
if [ ! -S /run/user/1200/docker.sock ]; then pass 'rootless Docker socket absent'; else fail 'rootless Docker socket exists'; fi
|
||||||
|
|
||||||
|
public_ipv4=$(/usr/bin/curl -4fsS --max-time 10 https://api.ipify.org 2>/dev/null)
|
||||||
|
if [ "$public_ipv4" = 74.67.173.56 ]; then pass 'public/NAT IPv4 unchanged'; else fail "public/NAT IPv4 drift or lookup failure: ${public_ipv4:-unavailable}"; fi
|
||||||
|
|
||||||
|
printf 'root pre-install validation failures=%s\n' "$failures"
|
||||||
|
[ "$failures" -eq 0 ]
|
||||||
|
|
@ -0,0 +1,41 @@
|
||||||
|
#!/bin/sh
|
||||||
|
set -eu
|
||||||
|
fail=0
|
||||||
|
expect_denied() { if "$@" >/dev/null 2>&1; then echo "UNEXPECTED SUCCESS: $*" >&2; fail=1; fi; }
|
||||||
|
|
||||||
|
test "$(id -u)" -eq 1200
|
||||||
|
test "$DOCKER_HOST" = unix:///run/user/1200/docker.sock
|
||||||
|
touch /srv/le-app-codex/tmp/phase2b-write-test
|
||||||
|
rm /srv/le-app-codex/tmp/phase2b-write-test
|
||||||
|
expect_denied ls /var/www
|
||||||
|
expect_denied ls /root
|
||||||
|
expect_denied ls /home
|
||||||
|
expect_denied ls /srv/directus-archive
|
||||||
|
expect_denied ls /srv/codex-work
|
||||||
|
expect_denied stat /run/docker.sock
|
||||||
|
expect_denied stat /var/run/docker.sock
|
||||||
|
expect_denied stat /run/containerd/containerd.sock
|
||||||
|
expect_denied stat /dev/sda
|
||||||
|
expect_denied stat /proc/1/root
|
||||||
|
expect_denied sh -c 'echo x > /etc/phase2b-write-test'
|
||||||
|
expect_denied sh -c 'echo x > /srv/phase2b-write-test'
|
||||||
|
expect_denied curl -4fsS --connect-timeout 2 http://127.0.0.1
|
||||||
|
expect_denied curl -4fsS --connect-timeout 2 http://10.200.120.1
|
||||||
|
expect_denied curl -4fsS --connect-timeout 2 http://192.168.10.151
|
||||||
|
expect_denied nc -w2 -z 192.168.10.1 53
|
||||||
|
expect_denied curl -4fsS --connect-timeout 2 http://10.98.0.2
|
||||||
|
expect_denied curl -4fsS --connect-timeout 2 http://74.67.173.56
|
||||||
|
expect_denied curl -4fsS --connect-timeout 2 http://169.254.169.254/latest/meta-data/
|
||||||
|
expect_denied curl -6fsS --connect-timeout 2 https://[::1]/
|
||||||
|
expect_denied nc -w2 -z 1.1.1.1 25
|
||||||
|
expect_denied nc -w2 -z 1.1.1.1 465
|
||||||
|
expect_denied nc -w2 -z 1.1.1.1 587
|
||||||
|
test "$(ps -e --no-headers | wc -l)" -lt 32
|
||||||
|
test -w /dev/fuse
|
||||||
|
test -w /dev/net/tun
|
||||||
|
grep -q '^nameserver 9\.9\.9\.9$' /etc/resolv.conf
|
||||||
|
grep -q '^nameserver 149\.112\.112\.112$' /etc/resolv.conf
|
||||||
|
getent ahostsv4 example.com >/dev/null
|
||||||
|
test -r /sys/fs/cgroup/cpu.max
|
||||||
|
test -r /sys/fs/cgroup/memory.max
|
||||||
|
exit "$fail"
|
||||||
|
|
@ -0,0 +1,35 @@
|
||||||
|
#!/bin/sh
|
||||||
|
set -eu
|
||||||
|
fail=0
|
||||||
|
export HOME=/srv/le-app-codex/home
|
||||||
|
export DOCKER_HOST=unix:///run/user/1200/docker.sock
|
||||||
|
ALPINE='docker.io/library/alpine:3.23.3@sha256:25109184c71bdad752c8312a8623239686a9a2071e8825f20acb8f2198c3f659'
|
||||||
|
NGINX='docker.io/library/nginx:1.29.4-alpine@sha256:4870c12cd2ca986de501a804b4f506ad3875a0b1874940ba0a2c7f763f1855b2'
|
||||||
|
test "$(id -u)" -eq 1200
|
||||||
|
test -S /run/user/1200/docker.sock
|
||||||
|
test "$(docker context show)" = le-app-codex
|
||||||
|
test "$(docker context inspect le-app-codex --format '{{.Endpoints.docker.Host}}')" = unix:///run/user/1200/docker.sock
|
||||||
|
docker info --format '{{json .SecurityOptions}}' | grep -q rootless
|
||||||
|
test "$(docker info --format '{{.DockerRootDir}}')" = /srv/le-app-codex/container-runtime/docker
|
||||||
|
docker run --rm --network none "$ALPINE" true
|
||||||
|
docker run --rm "$ALPINE" wget -qO- https://example.com >/dev/null
|
||||||
|
for target in 127.0.0.1 10.200.120.1 192.168.10.1 192.168.10.151 10.98.0.2 74.67.173.56 169.254.169.254; do
|
||||||
|
if docker run --rm "$ALPINE" wget -T2 -qO- "http://$target" >/dev/null 2>&1; then
|
||||||
|
echo "UNEXPECTED CONTAINER ACCESS: $target" >&2; fail=1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
if docker run --rm "$ALPINE" sh -c 'nc -w2 -z 1.1.1.1 25 || nc -w2 -z 1.1.1.1 465 || nc -w2 -z 1.1.1.1 587'; then
|
||||||
|
echo 'UNEXPECTED CONTAINER SMTP ACCESS' >&2; fail=1
|
||||||
|
fi
|
||||||
|
cid=$(docker run -d --rm -p 18080:80 "$NGINX")
|
||||||
|
trap 'docker rm -f "$cid" >/dev/null 2>&1 || true' EXIT
|
||||||
|
sleep 2
|
||||||
|
for host in 127.0.0.1 192.168.10.151 10.98.0.2; do
|
||||||
|
if curl -fsS --connect-timeout 2 "http://$host:18080" >/dev/null 2>&1; then
|
||||||
|
echo "UNEXPECTED PUBLISHED PORT: $host" >&2; fail=1
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
docker rm -f "$cid" >/dev/null
|
||||||
|
trap - EXIT
|
||||||
|
test ! -S /run/docker.sock || ! docker -H unix:///run/docker.sock info >/dev/null 2>&1
|
||||||
|
exit "$fail"
|
||||||
|
|
@ -0,0 +1,20 @@
|
||||||
|
#!/bin/sh
|
||||||
|
set -eu
|
||||||
|
test "$(id -u)" -eq 0
|
||||||
|
test "$(systemctl is-active user@1200.service || true)" = inactive
|
||||||
|
systemd-run --wait --pipe --collect --unit=le-app-codex-inert-test \
|
||||||
|
--uid=1200 --gid=1200 \
|
||||||
|
--setenv=DOCKER_HOST=unix:///run/user/1200/docker.sock \
|
||||||
|
--property=NetworkNamespacePath=/run/netns/le-app-codex \
|
||||||
|
--property=ProtectSystem=strict --property=PrivateTmp=yes \
|
||||||
|
--property=ProtectHome=yes --property=ProtectProc=invisible \
|
||||||
|
--property=TemporaryFileSystem=/srv:ro \
|
||||||
|
--property=BindPaths=/srv/le-app-codex:/srv/le-app-codex \
|
||||||
|
--property=TemporaryFileSystem=/var:ro \
|
||||||
|
--property=TemporaryFileSystem=/mnt:ro \
|
||||||
|
--property=TemporaryFileSystem=/media:ro \
|
||||||
|
--property=TemporaryFileSystem=/opt:ro \
|
||||||
|
--property=DevicePolicy=closed --property='DeviceAllow=/dev/fuse rw' \
|
||||||
|
--property='DeviceAllow=/dev/net/tun rw' \
|
||||||
|
/srv/le-app-codex/phase2b-tests/10-inert-containment.sh
|
||||||
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue