[WIP] Tag Bazel sandbox cgroups with network class for firewall restrictions

[lihaoyi-databricks]

This seems to work for network connections originating in the sandbox.

Haven't managed to get this to work for network connections originating in docker containers spawned by the sandbox

# this works and blocks outbound network from inside docker containers
sudo iptables -I DOCKER-USER -d 0.0.0.0/0 -o docker0 -j REJECT

# this fails with
# iptables: Invalid argument. Run `dmesg' for more information.
# x_tables: ip_tables: cgroup match: used from hooks FORWARD, but only valid from INPUT/OUTPUT/POSTROUTING
sudo iptables -I DOCKER-USER -m cgroup --cgroup 0x100001 -d 0.0.0.0/0 -o docker0 -j REJECT

# None of these work to block outbound traffic from the docker container
sudo iptables -I OUTPUT -d 0.0.0.0/0 -o docker0 -j REJECT
sudo iptables -I OUTPUT -d 0.0.0.0/0 -o docker0 -j DROP
sudo iptables -A OUTPUT -d 0.0.0.0/0 -o docker0 -j REJECT
sudo iptables -A OUTPUT -d 0.0.0.0/0 -o docker0 -j DROP

# POSTROUTING cannot reject or drop packetssudo iptables -A OUTPUT -s 192.168.1.2 -j DROP
sudo iptables -t nat -I POSTROUTING -d 0.0.0.0/0 -o docker0 -j REJECT
sudo iptables -t nat -I POSTROUTING -d 0.0.0.0/0 -o docker0 -j DROP

# This turns off networking from the entire devbox and kills SSH
sudo iptables -I OUTPUT -d 0.0.0.0/0  -j REJECT

# This doesn't seem to block outbound traffic from docker containers,
# seems like it's from an outdated version of docker documentation
sudo iptables -I DOCKER -i ext_if ! -s 8.8.8.8 -j DROP

# This doesn't do anything either, even though it's from the latest docker docs
sudo iptables -I DOCKER-USER -i ext_if ! -s 192.168.1.1 -j DROP

# this seems to block things properly
sudo iptables -I DOCKER-USER -j DROP

# this doesn't block things
sudo iptables -I OUTPUT -d 172.17.0.0/16 -j DROP
sudo iptables -I OUTPUT -s 172.17.0.2 -j DROP
sudo iptables -A OUTPUT -s 172.17.0.2 -j DROP


# This doesn't seem to work
sudo mkdir /sys/fs/cgroup/net_cls/my_cg
sudo bash -c "echo 0x100001 > /sys/fs/cgroup/net_cls/my_cg/net_cls.classid"
sudo iptables -t mangle -A INPUT -m cgroup --cgroup 0x100001 -j CONNMARK --set-mark 1
sudo iptables -A FORWARD -m connmark --mark 1 -j DROP

docker run --cgroup-parent /my_cg/ -it --rm curlimages/curl www.example.com.
docker run --cgroup-parent /my_cg/ -it --rm ubuntu sleep 1000