37

I am writing a dockerfile and I need IPtables to be installed in docker container. I need to add a rule to the IP table as I am trying to run on "host" network mode and it seems I need install IPtables for this purpose. when I try to include the rule as follows I get the following error.

iptables -I INPUT -p tcp -m tcp --dport 8080 -j ACCEPT


iptables v1.6.0: can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.

Is it possible to run iptables with root privileges.

3
  • 1
    How to configure this under Compose 3 ?
    – Stephane
    Sep 22, 2019 at 17:06
  • 2
    just add cap_add: - NET_ADMIN - NET_RAW
    – zar3bski
    Nov 11, 2019 at 11:21
  • your post saved my day
    – zar3bski
    Nov 11, 2019 at 11:21

2 Answers 2

68

--privileged flag is not required anymore. Starting with Docker 1.2 you can now run your image with parameters --cap-add=NET_ADMIN and --cap-add=NET_RAW which will allow internal iptables.

4
  • Aren't Ip tables configured at build time? In that case, those options do not work; how to do it in that case?
    – PptSbzzgt
    Mar 23, 2021 at 7:46
  • you can define iptables rules when the container is running
    – Dmitriusan
    Apr 4, 2021 at 21:21
  • What would NET_RAW be needed for? Doesn't NET_ADMIN suffice for many use cases?
    – Gasp0de
    Nov 8, 2021 at 13:04
  • Does this allow modification of iptables within the container only? Or does it modify the hosts iptables as well?
    – ZaxLofful
    Aug 1, 2022 at 3:47
-1

Google to the rescue.

IPTables in docker

Docker runtime privilege

TLDR version:

 docker run --privileged
4
  • 4
    While correct, IMHO feel like this is a Bad Idea for anything approaching a production environment (or development that is internet accessible) for the same reason why you don't run services as root. OP, please be very careful. There are better ways to skin this cat, IMHO.
    – Nick Burke
    Jan 17, 2017 at 21:46
  • 2
    Agreed, but I just answered the question because I hate it when people cross examine -vs- answering the question. Jan 17, 2017 at 21:47
  • 2
    Agree with that. I don't know the circumstances that OP is up to, but figured I'd toss the warning in just in case.
    – Nick Burke
    Jan 17, 2017 at 22:09
  • I agree with both of you that it is a bad idea to run it with --privileged but this is a special circumstance where I need to debug an issue on a developer setup. Thanks @NickBurke I tried that and it works. But I forgot to mention that I was running everything(There are a few services involved which all of them are running as docker containers) on a docker-compose and that's where I hit the issue.I tried changing the user to root but did not help. There are a lot of repetitive tasks so I really don't want to start each and every service individually.
    – Tharanga
    Jan 18, 2017 at 6:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.