(Created page with "{{admon/important | Comments and Explanations | The page source contains comments providing guidance to fill out each section. They are invisible when viewing this page. To read it, choose the "view source" link.<br/> '''Copy the source to a ''new page'' before making changes! DO NOT EDIT THIS TEMPLATE FOR YOUR CHANGE PROPOSAL.'''}} {{admon/tip | Guidance | For details on how to fill out this form, see the [https://docs.fedoraproject.org/en-US/program_management/change...") |
(announcing the change) |
||
(4 intermediate revisions by 2 users not shown) | |||
Line 1: | Line 1: | ||
= Netavark Nftables Default <!-- The name of your change proposal --> = | = Netavark Nftables Default <!-- The name of your change proposal --> = | ||
Line 16: | Line 8: | ||
Netavark should use nftables by default to create/manage the firewall rules for the Podman containers. | Netavark should use nftables by default to create/manage the firewall rules for the Podman containers. | ||
== Owner == | |||
* Name: [[User:FASAcountName| Paul Holzinger]] | * Name: [[User:FASAcountName| Paul Holzinger]] | ||
* Email: <pholzing@redhat.com> | |||
* Email: <pholzing | |||
* Name: Matthew Heon | * Name: Matthew Heon | ||
* Email: <mheon@redhat.com> | * Email: <mheon@redhat.com> | ||
== Current status == | == Current status == | ||
[[Category: | [[Category:ChangeAnnounced]] | ||
<!-- When your change proposal page is completed and ready for review and announcement --> | <!-- When your change proposal page is completed and ready for review and announcement --> | ||
<!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler --> | <!-- remove Category:ChangePageIncomplete and change it to Category:ChangeReadyForWrangler --> | ||
Line 39: | Line 22: | ||
<!-- After review, the Wrangler will move your page to Category:ChangeReadyForFesco... if it still needs more work it will move back to Category:ChangePageIncomplete--> | <!-- After review, the Wrangler will move your page to Category:ChangeReadyForFesco... if it still needs more work it will move back to Category:ChangePageIncomplete--> | ||
[[Category:SelfContainedChange]] | [[Category:SelfContainedChange]] | ||
* Targeted release: [https://docs.fedoraproject.org/en-US/releases/f41/ Fedora Linux 41] | * Targeted release: [https://docs.fedoraproject.org/en-US/releases/f41/ Fedora Linux 41] | ||
Line 51: | Line 32: | ||
ON_QA -> change is fully code complete | ON_QA -> change is fully code complete | ||
--> | --> | ||
* [Announced] | * [https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org/thread/A7ZVLT2JMLQT5YVTCFGHQVYQ5WIBFQML/ Announced] | ||
* [ | * [https://discussion.fedoraproject.org/t/f41-change-proposal-netavark-nftables-default-self-contained/125528 Discussion thread] | ||
* FESCo issue: <will be assigned by the Wrangler> | * FESCo issue: <will be assigned by the Wrangler> | ||
* Tracker bug: <will be assigned by the Wrangler> | * Tracker bug: <will be assigned by the Wrangler> | ||
Line 58: | Line 39: | ||
== Detailed Description == | == Detailed Description == | ||
Netavark is used by Podman to configure networking for the containers. It manages interfaces and firewall rules. Currently it uses iptables by default to create the firewall rules for the containers but it can also be configured to use nftables (nft). The goal is to switch the default over to nftables. | Netavark is used by Podman to configure networking for the containers. It manages interfaces and firewall rules. Currently it uses iptables by default to create the firewall rules for the containers but it can also be configured to use nftables (nft). The goal is to switch the default over to nftables. We also expect a small speed up for the container start-up times as nftables allows us to batch insert rules at once which makes it more performant and robust compared to iptables. | ||
== Feedback == | == Feedback == | ||
Line 66: | Line 46: | ||
== Benefit to Fedora == | == Benefit to Fedora == | ||
* netavark no longer requires iptables | * netavark no longer requires iptables | ||
* all rules are now part of the netavark table so there are less conflicts with other tools/users who manage firewall rules | * all rules are now part of the netavark table so there are less conflicts with other tools/users who manage firewall rules | ||
* slightly faster container start-up time | |||
== Scope == | == Scope == | ||
* Proposal owners: Paul Holzinger, Matthew Heon | * Proposal owners: Paul Holzinger, Matthew Heon | ||
** Using nftables is already supported in netavark as of version v1.10 (already included in fedora). Set a build option in the specfile to change the default driver from iptables to nftables | ** Using nftables is already supported in netavark as of version v1.10 (already included in fedora). Set a build option in the specfile to change the default driver from iptables to nftables | ||
* Other developers: | * Other developers: N/A | ||
* Release engineering: | * Release engineering: N/A | ||
* Policies and guidelines: N/A (not needed for this Change) | * Policies and guidelines: N/A (not needed for this Change) | ||
* Trademark approval: N/A (not needed for this Change) | * Trademark approval: N/A (not needed for this Change) | ||
* Alignment with the Fedora Strategy: | * Alignment with the Fedora Strategy: | ||
== Upgrade/compatibility impact == | == Upgrade/compatibility impact == | ||
Line 125: | Line 73: | ||
== Early Testing (Optional) == | == Early Testing (Optional) == | ||
Do you require 'QA Blueprint' support? | Do you require 'QA Blueprint' support? N | ||
== How To Test == | == How To Test == | ||
The change can be tested by setting the firewall driver to nftables in containers.conf: | The change can be tested by setting the firewall driver to nftables in containers.conf: | ||
Line 154: | Line 88: | ||
$ sudo nft list table inet netavark | $ sudo nft list table inet netavark | ||
== User Experience == | == User Experience == | ||
There should no change in behavior for end users unless they manually messed with the netavark firewall rules. | There should no change in behavior for end users unless they manually messed with the netavark firewall rules. | ||
== Dependencies == | == Dependencies == | ||
N/A | N/A | ||
== Contingency Plan == | == Contingency Plan == | ||
* Contingency mechanism: Keep using iptables as default. | * Contingency mechanism: Keep using iptables as default. | ||
* Contingency deadline: beta freeze | * Contingency deadline: beta freeze | ||
* Blocks release? N/A | * Blocks release? N/A | ||
== Documentation == | == Documentation == | ||
N/A (not a System Wide Change) | N/A (not a System Wide Change) | ||
Latest revision as of 15:39, 12 July 2024
Netavark Nftables Default
Summary
Netavark should use nftables by default to create/manage the firewall rules for the Podman containers.
Owner
- Name: Paul Holzinger
- Email: <pholzing@redhat.com>
- Name: Matthew Heon
- Email: <mheon@redhat.com>
Current status
- Targeted release: Fedora Linux 41
- Last updated: 2024-07-12
- Announced
- Discussion thread
- FESCo issue: <will be assigned by the Wrangler>
- Tracker bug: <will be assigned by the Wrangler>
- Release notes tracker: <will be assigned by the Wrangler>
Detailed Description
Netavark is used by Podman to configure networking for the containers. It manages interfaces and firewall rules. Currently it uses iptables by default to create the firewall rules for the containers but it can also be configured to use nftables (nft). The goal is to switch the default over to nftables. We also expect a small speed up for the container start-up times as nftables allows us to batch insert rules at once which makes it more performant and robust compared to iptables.
Feedback
Benefit to Fedora
- netavark no longer requires iptables
- all rules are now part of the netavark table so there are less conflicts with other tools/users who manage firewall rules
- slightly faster container start-up time
Scope
- Proposal owners: Paul Holzinger, Matthew Heon
- Using nftables is already supported in netavark as of version v1.10 (already included in fedora). Set a build option in the specfile to change the default driver from iptables to nftables
- Other developers: N/A
- Release engineering: N/A
- Policies and guidelines: N/A (not needed for this Change)
- Trademark approval: N/A (not needed for this Change)
- Alignment with the Fedora Strategy:
Upgrade/compatibility impact
Early Testing (Optional)
Do you require 'QA Blueprint' support? N
How To Test
The change can be tested by setting the firewall driver to nftables in containers.conf:
$ sudo mkdir -p /etc/containers/containers.conf.d $ echo $'[network]\nfirewall_driver="nftables"' | sudo tee /etc/containers/containers.conf.d/50-netavark-nftables.conf
Changing the firewall driver while you have running containers will likely cause some conflicting rules so it is best to reboot when this option is changed.
Now start the containers and make sure the network works as usual. The rules can be checked with
$ sudo nft list table inet netavark
User Experience
There should no change in behavior for end users unless they manually messed with the netavark firewall rules.
Dependencies
N/A
Contingency Plan
- Contingency mechanism: Keep using iptables as default.
- Contingency deadline: beta freeze
- Blocks release? N/A
Documentation
N/A (not a System Wide Change)