Windows Server Core in Docker, Firewall

元气小坏坏 提交于 2021-02-11 13:30:46

问题


Currently I am working on a project where I have to dockerize an application that is supposed to be running on Windows. It is an application that can be installed and configured via command line. The question is applicable to any application in the end.

The platform of my choice is obviously Windows. Therefore I have chosen a base image mcr.microsoft.com/windows/servercore:1803 to begin with.

After installation my application will need a rule added to Firewall. So I decided to test whether I am able to manipulate the firewall inside a container. It turned out a very problematic experience.

What I've done so far.

FROM mcr.microsoft.com/windows/servercore:1803

# Add user 
RUN net user /add MyUser
RUN net user MyUser ABCdef123!
RUN net localgroup "Administrators" MyUser /add

After that I have tested whether I can see the FW rules by calling Get-NetFirewallRule. Tis resulted in an error :

Get-NetFirewallRule : There are no more endpoints available from the endpoint mapper.
At line:1 char:1
+ Get-NetFirewallRule
+ ~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (MSFT_NetFirewallRule:root/standardcimv2/MSFT_NetFirewallRule) [Get-NetFirewallRule], CimException
    + FullyQualifiedErrorId : Windows System Error 1753,Get-NetFirewallRule

I checked the services that run currently by calling Get-Service which resulted in the list of services containing this line: Stopped mpssvc Windows Defender Firewall. Looks like the FW is not even started. I decided to dig deeper and check registry for some clues. Calling this cmd REG QUERY HKLM\SYSTEM\CurrentControlSet\services\MpsSvc /v Start gave me a value of 4 which is Disabled. So i tried to enable it, setting it to 2 but no luck starting the service after:

REG ADD HKLM\SYSTEM\CurrentControlSet\services\MpsSvc /v Start /t REG_DWORD /d 2 /f
net start MpsSvc

Result:

System error 1058 has occurred.
The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

The dependent to FW services are running fine (BFE, RDC etc) It just wont start.

Any clues from bright minds? Thanks in advance!


回答1:


Assuming you use Windows Server Container, not Hyper-V Container, you have a shared Kernel hence use the Host's firewall.

From Network Isolation and Security:

Depending on which container and network driver is used, port ACLs are enforced by a combination of the Windows Firewall and VFP.

Windows Server containers

These use the Windows hosts' firewall (enlightened with network namespaces) as well as VFP

Default Outbound: ALLOW ALL

Default Inbound: ALLOW ALL (TCP, UDP, ICMP, IGMP) unsolicited network traffic

DENY ALL other network traffic not from these protocols



来源:https://stackoverflow.com/questions/53484200/windows-server-core-in-docker-firewall

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!