[Carry 18926] Add network internal mode #19276

calavera · 2016-01-12T23:21:48Z

Signed-off-by: Chun Chen ramichen@tencent.com
Signed-off-by: David Calavera david.calavera@gmail.com

thaJeztah · 2016-01-12T23:33:32Z

docs/reference/api/docker_remote_api.md

@@ -113,6 +113,7 @@ This section lists each version from latest to oldest.  Each listing includes a
 * `GET /networks` now supports filtering by `name`, `id` and `type`.
 * `POST /containers/create` now allows you to set the static IPv4 and/or IPv6 address for the container.
 * `POST /networks/(id)/connect` now allows you to set the static IPv4 and/or IPv6 address for the container.
+* `POST /networks/create` now supports restricting external access to the network by setting a `internal` field.


an internal field... but the CI is almost green lol

actually this should be the internal field, as @calavera privately suggested to me

lol, yes, I only looked at the missing ., haha

replaced with the, because it's a specific field, not any, like a or an might suggest.

thaJeztah · 2016-01-12T23:34:27Z

LGTM

tiborvass · 2016-01-12T23:42:10Z

apart from small nit, LGTM

chenchun · 2016-01-13T01:11:15Z

Thanks for carrying this.

xiangpengzhao · 2016-01-13T01:40:32Z

All the existing [OPTIONS] of docker network create command (and almost other docker commands) are in the format as --option_name=option_value, so should we give the option --internal the same format as --internal=bool?

I think this will keep unify style of commands and help users to understand the option better.

@calavera @chenchun

thaJeztah · 2016-01-13T01:48:27Z

@xiangpengzhao we no longer show =false on boolean flags. See #18082

xiangpengzhao · 2016-01-13T01:58:52Z

Sorry for not noticing that issue:sweat_smile:
@thaJeztah

sdurrheimer · 2016-01-13T07:09:36Z

ping @albers future docker network create --internal flag

vdemeester · 2016-01-13T07:59:24Z

docs/reference/commandline/network_create.md

@@ -22,6 +22,7 @@ parent = "smn_cli"
    --ipam-driver=default    IP Address Management Driver
    -o --opt=map[]           Set custom network plugin options
    --subnet=[]              Subnet in CIDR format that represents a network segment
+    --internal               Restricts external access to the network


Should be upwards, just before --ip-range.

vdemeester · 2016-01-13T08:01:28Z

Small nits that could be done before merging (that's why I did put it back into docs review 😝)

thaJeztah · 2016-01-13T08:13:14Z

good catch, @vdemeester

icecrime · 2016-01-13T16:15:10Z

Also needs a rebase 🐱

Signed-off-by: Chun Chen <ramichen@tencent.com> Signed-off-by: David Calavera <david.calavera@gmail.com>

calavera · 2016-01-13T16:31:12Z

fixed comments and rebased

vdemeester · 2016-01-13T16:53:21Z

docs LGTM 🐹

calavera · 2016-01-13T18:13:16Z

all 💚 🎉

[Carry 18926] Add network internal mode

alvinr · 2016-01-21T06:18:04Z

Not clear if this was intentional, but with --internal specified then the ports exposed do do appear in docker inspect. This breaks docker ps which shows empty values and utilities like interlock for HAproxy configuration.

Without --internal then you see the following stanza. This is excluded with the --internal flag.

        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "45f20f5d699fe7fa7ea5ac95217ebea5b3cc47fd62202d8f430646e6d43e2a00",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "5000/tcp": [
                    {
                        "HostIp": "172.16.145.155",
                        "HostPort": "32768"
                    }
                ]
            },

GordonTheTurtle added the status/0-triage label Jan 12, 2016

calavera mentioned this pull request Jan 12, 2016

Add network internal mode #18926

Closed

calavera added this to the 1.10.0 milestone Jan 12, 2016

thaJeztah changed the title ~~[Carry 18926] Add network interal mode~~ [Carry 18926] Add network internal mode Jan 12, 2016

thaJeztah added status/3-docs-review and removed status/0-triage labels Jan 12, 2016

thaJeztah reviewed Jan 12, 2016
View reviewed changes

calavera force-pushed the internal branch from b5e1471 to ae8d6e4 Compare January 13, 2016 00:07

tiborvass added status/4-merge and removed status/3-docs-review labels Jan 13, 2016

vdemeester reviewed Jan 13, 2016
View reviewed changes

vdemeester added status/3-docs-review and removed status/4-merge labels Jan 13, 2016

Add network interal mode

b70954e

Signed-off-by: Chun Chen <ramichen@tencent.com> Signed-off-by: David Calavera <david.calavera@gmail.com>

calavera force-pushed the internal branch from ae8d6e4 to b70954e Compare January 13, 2016 16:31

vdemeester added the status/4-merge label Jan 13, 2016

vdemeester removed the status/3-docs-review label Jan 13, 2016

calavera added a commit that referenced this pull request Jan 13, 2016

Merge pull request #19276 from calavera/internal

0ee6412

[Carry 18926] Add network internal mode

calavera merged commit 0ee6412 into moby:master Jan 13, 2016

calavera deleted the internal branch January 13, 2016 18:13

thaJeztah added the impact/changelog label Jan 14, 2016

thaJeztah mentioned this pull request Jan 15, 2016

Display internal flag on network inspect docker/engine-api#47

Merged

sdurrheimer mentioned this pull request Jan 16, 2016

Add zsh completion for 'docker network create --internal' #19386

Merged

albers mentioned this pull request Jan 18, 2016

Update bash completion for docker network create #19411

Merged

thaJeztah mentioned this pull request Jan 21, 2016

Add option to disable docker_gwbridge on overlay networks. #18854

Closed

dongluochen mentioned this pull request Feb 2, 2016

swarm doesn't support docker network create --internal flag docker-archive/classicswarm#1737

Closed

thaJeztah mentioned this pull request Apr 20, 2016

Containers can talk to the host over the network even with ICC disabled #21990

Open

yajo mentioned this pull request Nov 11, 2017

Use --internal with sane defaults in scaffoldings Tecnativa/doodba#98

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Carry 18926] Add network internal mode #19276

[Carry 18926] Add network internal mode #19276

calavera commented Jan 12, 2016

thaJeztah Jan 12, 2016

tiborvass Jan 12, 2016

tiborvass Jan 12, 2016

thaJeztah Jan 13, 2016

calavera Jan 13, 2016

thaJeztah commented Jan 12, 2016

tiborvass commented Jan 12, 2016

chenchun commented Jan 13, 2016

xiangpengzhao commented Jan 13, 2016

thaJeztah commented Jan 13, 2016

xiangpengzhao commented Jan 13, 2016

sdurrheimer commented Jan 13, 2016

vdemeester Jan 13, 2016

vdemeester commented Jan 13, 2016

thaJeztah commented Jan 13, 2016

icecrime commented Jan 13, 2016

calavera commented Jan 13, 2016

vdemeester commented Jan 13, 2016

calavera commented Jan 13, 2016

alvinr commented Jan 21, 2016

[Carry 18926] Add network internal mode #19276

[Carry 18926] Add network internal mode #19276

Conversation

calavera commented Jan 12, 2016

thaJeztah Jan 12, 2016

Choose a reason for hiding this comment

tiborvass Jan 12, 2016

Choose a reason for hiding this comment

tiborvass Jan 12, 2016

Choose a reason for hiding this comment

thaJeztah Jan 13, 2016

Choose a reason for hiding this comment

calavera Jan 13, 2016

Choose a reason for hiding this comment

thaJeztah commented Jan 12, 2016

tiborvass commented Jan 12, 2016

chenchun commented Jan 13, 2016

xiangpengzhao commented Jan 13, 2016

thaJeztah commented Jan 13, 2016

xiangpengzhao commented Jan 13, 2016

sdurrheimer commented Jan 13, 2016

vdemeester Jan 13, 2016

Choose a reason for hiding this comment

vdemeester commented Jan 13, 2016

thaJeztah commented Jan 13, 2016

icecrime commented Jan 13, 2016

calavera commented Jan 13, 2016

vdemeester commented Jan 13, 2016

calavera commented Jan 13, 2016

alvinr commented Jan 21, 2016