https://github.com/gr455/contain
BPF based per-process per-container egress filter
https://github.com/gr455/contain
Last synced: 3 months ago
JSON representation
BPF based per-process per-container egress filter
- Host: GitHub
- URL: https://github.com/gr455/contain
- Owner: gr455
- License: gpl-3.0
- Created: 2023-04-18T15:58:25.000Z (over 3 years ago)
- Default Branch: master
- Last Pushed: 2024-01-27T01:55:48.000Z (over 2 years ago)
- Last Synced: 2025-02-26T20:23:23.542Z (over 1 year ago)
- Language: C
- Homepage:
- Size: 113 KB
- Stars: 2
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Contain
BPF based per-process per-container egress filter.
Filters outgoing traffic from containers based on the container and the process the traffic originated from. Once containd is running, it automatically detects any new containers.
## Run
**Requires cgroup v2**
1. Update `blacklist.json` with your own allow list.
2. To start Contain daemon, run
```
python3 containd.py
```
When the daemon is running, it detects any newly started containers and applies policies to them.
Once started, the allow list
```json
[
{
"container_name": "curler", // Only add a single object per container
"policy": [
{
"process": "curl", // Only add a single object per process, add one/multiple objects per container
"allow": [
{
"cidr4": "1.1.1.0/24",
"ports": [80, 443]
}
]
}
]
}
]
```
Gives
This BPF filter uses `BPF_PROG_TYPE_CGROUP_SKB` and a kretprobe to kernel function `net/socket/sock_alloc_file` for per-process, per-container socket filtering.
Tested on Linux 5.19.0 - 6.2.0