prevent imds access on nsjail using iptables

2025-07-13 13:04:33 +00:00
parent e7e27259ee
commit 3906b5ad96
1 changed files with 4 additions and 0 deletions
--- a/docker/DockerfileNsjail
+++ b/docker/DockerfileNsjail
@@ -70,5 +70,9 @@ RUN curl -fLo coursier https://github.com/coursier/coursier/releases/download/v2
 	&& chmod +x /usr/bin/coursier
 RUN /usr/bin/java -jar /usr/bin/coursier about

+# iptables
+RUN apt-get install -y iptables
+RUN iptables -A OUTPUT -d 169.254.169.254 -j DROP && iptables -A FORWARD -d 169.254.169.254 -j DROP
+
 COPY --from=nsjail /nsjail/nsjail /bin/nsjail