From 78e07859503d03277d2f1b01c491231252d962ee Mon Sep 17 00:00:00 2001 From: shota-0129 Date: Wed, 30 Jul 2025 14:22:15 +0900 Subject: [PATCH] simplify Docker DNS restoration using grep and xargs approach --- .devcontainer/init-firewall.sh | 24 ++++++++++-------------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/.devcontainer/init-firewall.sh b/.devcontainer/init-firewall.sh index ed31583c..a410c5c7 100644 --- a/.devcontainer/init-firewall.sh +++ b/.devcontainer/init-firewall.sh @@ -2,9 +2,8 @@ set -euo pipefail # Exit on error, undefined vars, and pipeline failures IFS=$'\n\t' # Stricter word splitting -# Extract Docker DNS ports before cleanup (for protection) -TCP_PORT=$(iptables -t nat -L DOCKER_OUTPUT -n 2>/dev/null | grep 'tcp.*to:127.0.0.11:' | sed 's/.*127\.0\.0\.11://g' | cut -d' ' -f1 || echo "") -UDP_PORT=$(iptables -t nat -L DOCKER_OUTPUT -n 2>/dev/null | grep 'udp.*to:127.0.0.11:' | sed 's/.*127\.0\.0\.11://g' | cut -d' ' -f1 || echo "") +# 1. Extract Docker DNS info BEFORE any flushing +DOCKER_DNS_RULES=$(iptables-save -t nat | grep "127\.0\.0\.11") # Flush existing rules and delete existing ipsets iptables -F @@ -15,17 +14,14 @@ iptables -t mangle -F iptables -t mangle -X ipset destroy allowed-domains 2>/dev/null || true -# Restore Docker DNS NAT rules if they existed -if [ -n "$TCP_PORT" ] && [ -n "$UDP_PORT" ]; then - echo "Restoring Docker DNS with TCP:$TCP_PORT, UDP:$UDP_PORT" - iptables -t nat -N DOCKER_OUTPUT - iptables -t nat -N DOCKER_POSTROUTING - iptables -t nat -A OUTPUT -d 127.0.0.11/32 -j DOCKER_OUTPUT - iptables -t nat -A POSTROUTING -d 127.0.0.11/32 -j DOCKER_POSTROUTING - iptables -t nat -A DOCKER_OUTPUT -d 127.0.0.11/32 -p tcp -j DNAT --to-destination 127.0.0.11:$TCP_PORT - iptables -t nat -A DOCKER_OUTPUT -d 127.0.0.11/32 -p udp -j DNAT --to-destination 127.0.0.11:$UDP_PORT - iptables -t nat -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p tcp -j SNAT --to-source :53 - iptables -t nat -A DOCKER_POSTROUTING -s 127.0.0.11/32 -p udp -j SNAT --to-source :53 +# 2. Selectively restore ONLY internal Docker DNS resolution +if [ -n "$DOCKER_DNS_RULES" ]; then + echo "Restoring Docker DNS rules..." + iptables -t nat -N DOCKER_OUTPUT 2>/dev/null || true + iptables -t nat -N DOCKER_POSTROUTING 2>/dev/null || true + echo "$DOCKER_DNS_RULES" | xargs -L 1 iptables -t nat +else + echo "No Docker DNS rules to restore" fi # First allow DNS and localhost before any restrictions