Implement docker outgoing firewall #254
Conversation
WalkthroughWalkthroughThe update enhances the system by introducing the capability to specify allowed outgoing IP addresses for jobs, likely aimed at bolstering security and managing network traffic. This new feature spans multiple components, impacting job object creation, Docker-based job execution, and worker job handling. It involves incorporating a parameter to track permitted IPs and setting up network rules to restrict outgoing traffic to these designated addresses during job execution. Changes
Recent Review DetailsConfiguration used: CodeRabbit UI Files selected for processing (1)
Additional comments not posted (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Actionable comments outside the diff hunks (4)
vmms/localDocker.py (3)
Line range hint
5-5: Remove unused importrandom.- import random
Line range hint
10-10: Remove unused importthreading.- import threading
Line range hint
12-12: Remove unused importsys.- import sysrestful_tango/tangoREST.py (1)
Line range hint
19-21: Move module-level imports to the top of the file.- currentdir = os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe()))) - parentdir = os.path.dirname(currentdir) - sys.path.insert(0, parentdir) + import sys + import os + import inspect + currentdir = os.path.dirname(os.path.abspath(inspect.getfile(inspect.currentframe()))) + parentdir = os.path.dirname(currentdir) + sys.path.insert(0, parentdir)
There was a problem hiding this comment.
Actionable comments posted: 1
Actionable comments outside the diff hunks (3)
vmms/localDocker.py (3)
Line range hint
5-5: Remove unused importrandom.- import random
Line range hint
10-10: Remove unused importthreading.- import threading
Line range hint
12-12: Remove unused importsys.- import sys
| iptablesCmd += "iptables -A OUTPUT -d 8.8.8.8 -j ACCEPT; " | ||
| for IP in allowedOutgoingIPs: | ||
| iptablesCmd += f"iptables -A OUTPUT -d {IP} -j ACCEPT; " |
There was a problem hiding this comment.
Correct the static string in the f-string.
- iptablesCmd += "iptables -A OUTPUT -d 8.8.8.8 -j ACCEPT; "
+ iptablesCmd += f"iptables -A OUTPUT -d 8.8.8.8 -j ACCEPT; "Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation.
| iptablesCmd += "iptables -A OUTPUT -d 8.8.8.8 -j ACCEPT; " | |
| for IP in allowedOutgoingIPs: | |
| iptablesCmd += f"iptables -A OUTPUT -d {IP} -j ACCEPT; " | |
| iptablesCmd += f"iptables -A OUTPUT -d 8.8.8.8 -j ACCEPT; " | |
| for IP in allowedOutgoingIPs: | |
| iptablesCmd += f"iptables -A OUTPUT -d {IP} -j ACCEPT; " |
Description
Motivation and Context
How Has This Been Tested?