Re: sysctl behavior for docker-io

2013-10-15 Thread Miloslav Trmač
On Mon, Oct 7, 2013 at 3:47 PM, Richard W.M. Jones wrote: > Another way to look at it might be: Since a lot of people have libvirt > installed (it's the default isn't it?) and hence forwarding has been > on for many people for a long time, what harm is it causing? RFC 1812 > 2.2.8.1 Embedded Rout

Re: sysctl behavior for docker-io

2013-10-15 Thread Miloslav Trmač
On Sun, Oct 6, 2013 at 11:32 PM, Lennart Poettering wrote: > This is the general problem that IP forwarding is no local setting, and > that the global setting has no inherent concept of ownership or > refcounting. The proper place for this seems to be firewalld, which should not only control the

Re: sysctl behavior for docker-io

2013-10-07 Thread Till Maas
On Mon, Oct 07, 2013 at 10:06:51AM +0100, Daniel P. Berrange wrote: > We really only wanted to enable forwarding from virbr0, to the LAN, but > you can't toggle this per NIC afaick - you have to turn on the global There seems to be per-NIC settings at: /proc/sys/net/ipv*/conf/*/forwarding Regard

Re: sysctl behavior for docker-io

2013-10-07 Thread Richard W.M. Jones
On Mon, Oct 07, 2013 at 10:06:51AM +0100, Daniel P. Berrange wrote: > On Sun, Oct 06, 2013 at 07:25:50PM -0400, Matthew Miller wrote: > > On Sun, Oct 06, 2013 at 11:32:13PM +0200, Lennart Poettering wrote: > > > Or in other words: I don't think it makes much sense to turn this on > > > only at runt

Re: sysctl behavior for docker-io

2013-10-07 Thread Daniel P. Berrange
On Sun, Oct 06, 2013 at 07:25:50PM -0400, Matthew Miller wrote: > On Sun, Oct 06, 2013 at 11:32:13PM +0200, Lennart Poettering wrote: > > Or in other words: I don't think it makes much sense to turn this on > > only at runtime inside the service file as matthew suggests, as it hides > > the fact th

Re: sysctl behavior for docker-io

2013-10-06 Thread Matthew Miller
On Sun, Oct 06, 2013 at 11:32:13PM +0200, Lennart Poettering wrote: > Or in other words: I don't think it makes much sense to turn this on > only at runtime inside the service file as matthew suggests, as it hides > the fact that the setting is made, makes it hard for admins to discover > and overr

Re: sysctl behavior for docker-io

2013-10-06 Thread Lennart Poettering
On Fri, 04.10.13 16:04, Matthew Miller (mat...@fedoraproject.org) wrote: > On Fri, Oct 04, 2013 at 02:15:07PM -0500, Lokesh Mandvekar wrote: > > So, IP forwarding seems to be disabled by default in Fedora. docker-io > > requires IP forwarding enabled > > > > With respect to packaging, we'd like t

Re: sysctl behavior for docker-io

2013-10-04 Thread Josh Poimboeuf
On Fri, Oct 04, 2013 at 03:21:07PM -0500, Lokesh Mandvekar wrote: > On Fri, Oct 04, 2013 at 04:04:19PM -0400, Matthew Miller wrote: > > On Fri, Oct 04, 2013 at 02:15:07PM -0500, Lokesh Mandvekar wrote: > > > So, IP forwarding seems to be disabled by default in Fedora. docker-io > > > requires IP fo

Re: sysctl behavior for docker-io

2013-10-04 Thread Matthew Miller
On Fri, Oct 04, 2013 at 03:21:07PM -0500, Lokesh Mandvekar wrote: > Josh (cc'd) said libvirtd would enable it, but we still need to take care of > this for docker+lxc. If we pick libvirt-lxc as the preferred configuration, we can maybe get away with just documenting changes needed if you want to u

Re: sysctl behavior for docker-io

2013-10-04 Thread Lokesh Mandvekar
On Fri, Oct 04, 2013 at 04:04:19PM -0400, Matthew Miller wrote: > On Fri, Oct 04, 2013 at 02:15:07PM -0500, Lokesh Mandvekar wrote: > > So, IP forwarding seems to be disabled by default in Fedora. docker-io > > requires IP forwarding enabled > > > > With respect to packaging, we'd like to have doc

Re: sysctl behavior for docker-io

2013-10-04 Thread Matthew Miller
On Fri, Oct 04, 2013 at 02:15:07PM -0500, Lokesh Mandvekar wrote: > So, IP forwarding seems to be disabled by default in Fedora. docker-io > requires IP forwarding enabled > > With respect to packaging, we'd like to have docker-io installation set > sysctl values to enable IPv4 and IPv6 forwarding

sysctl behavior for docker-io

2013-10-04 Thread Lokesh Mandvekar
So, IP forwarding seems to be disabled by default in Fedora. docker-io requires IP forwarding enabled With respect to packaging, we'd like to have docker-io installation set sysctl values to enable IPv4 and IPv6 forwarding: https://bugzilla.redhat.com/show_bug.cgi?id=1011680 I was told on #fedora