dustymabe reported a new issue against the project: `atomic-wg` that you are following:
``
I started [a
thread](https://lists.projectatomic.io/projectatomic-archives/atomic-devel/2017-April/msg00022.html)
some time ago on including firewalld in atomic host. I don't believe we received any
major objections there so I'm going to propose we move forward with including it in
the host.
Some highlights from the mail thread:
- good for new users
since docker adds iptables rules dynamically it's really hard to properly get an
iptables config that accurately reflects the rules you want to add without including the
dynamic rules docker adds. Also if you do get a config that works and apply it while the
system is running then you lost the dynamic rules docker added.
- good for openshift origin / kubernetes
From @jdetiber : *The iptables-based management that is done in openshift-ansible has
always been a hack that was only meant to be a stopgap until firewalld was fully supported
up and down the entire stack. There are way too many edge cases that could cause issues
with the create/save/restore process. We tried to limit those by using a dedicated chain
for openshift-ansible rules, but having another process modify rules without using
'-w' or other modifications to the firewall could inadvertently be persisted with
the iptables-save.*
- make sure we avoid the default zones/policies from firewalld
from ben breard on list: if we include it we would want to *clean up the absurd default
zones & policies and have something relevant for AH out of the box*
``
To reply, visit the link below or just reply to this email
https://pagure.io/atomic-wg/issue/372