The relevant unit files.
See this excellent blog article for what the problem is and why these systemd units are useful. But the TLDR is that they listen and re-add firewall rules when they are removed by other actors (usually due to a flush or reload), so that rootful container don't lose connectivity.
I see that currently the existing unit files are directly committed into this repo. Doing similar is probably the easiest, but I feel it's better if we can somehow directly source them from upstream. Wdyt?
The relevant unit files.
See this excellent blog article for what the problem is and why these systemd units are useful. But the TLDR is that they listen and re-add firewall rules when they are removed by other actors (usually due to a flush or reload), so that rootful container don't lose connectivity.
I see that currently the existing unit files are directly committed into this repo. Doing similar is probably the easiest, but I feel it's better if we can somehow directly source them from upstream. Wdyt?