CODEWITHSUNDEEP
singularity-containerapptainer
luator
luator

Reputation: 5027

Restrict network access from Apptainer/Singularity container

Is it possible with Apptainer/Singularity to restrict which network interfaces can be used from within a container?

In my specific use-case I want to allow access to the internet but block access to some SocketCAN interfaces that are available on the host system. Is this possible?

I saw the --net/--network options but the documentation on this option not very detailed so I'm not sure how to use it (or if it can solve my problem at all).

Upvotes: 0

Views: 534

Answers (1)

luator
luator

Reputation: 5027

I got the answer from the Apptainer Slack channel (thanks to Cedric Clerget!):

In my specific case (allowing normal network access but hiding the SocketCAN interfaces), it is actually enough to add

--dns <IP of DNS server> --net --network=bridge  # or --network=ptp

Specifying the DNS server is needed when using systemd resolved. In other cases it may work without.

Upvotes: 1

Related Questions