mirror of
https://hubproxy.babadafafafafa.cn/https://github.com/docker-easyconnect/docker-easyconnect.git
synced 2026-09-21 00:23:33 +08:00
75fb271bd5
ATrust runs `sysctl -w net.ipv4.conf.utun7.route_localnet=1` before calling `iptables` to reject DNS. If the former command failed (usually because of leak of permission in container), aTrust will keep trying to rerun it but not reject DNS. This commit adds a sysctl wrapper, which will determine whether the value of `net.ipv4.conf.utun7.route_localnet` has been 1, and return 0 directly if yes. The value of `net.ipv4.conf.utun7.route_localnet` can be set without any extra permission given to the container, by `--sysctl net.ipv4.conf.default.route_localnet` as an argument of `docker/podman run`. Fix #286.