Rules added to the FORWARD chain - either manually, or by another These rules are appliedīefore any rules Docker creates automatically. If you need to add rules which load beforeĭocker’s rules, add them to the DOCKER-USER chain. Add iptables policies before Docker’s rulesĭocker installs two custom iptables chains named DOCKER-USER and DOCKER,Īnd it ensures that incoming packets are always checked by these two chainsĪll of Docker’s iptables rules are added to the DOCKER chain. This pageĭescribes how to achieve that, and what caveats you need to be aware of. Probably want to have iptables policies in place that prevent unauthorizedĪccess to containers or other services running on your host.

If you’re running Docker on a host that is exposed to the Internet, you will On what you need to do if you want to have your own policies in addition to

While this is an implementation detail and you should not modify the rulesĭocker inserts into your iptables policies, it does have some implications On Linux, Docker manipulates iptables rules to provide network isolation.

Centos iptables