rules::docker_ce allow passing '*' as interface name

[nbarrientos]

From nftables' manpage:

Like with iptables, wildcard matching on interface name prefixes is available for iifname and oifname matches by appending an asterisk (*) character. Note however that unlike iptables, nftables does not accept interface names consisting of the wildcard character only - users are supposed to just skip those always matching expressions. In order to match on literal asterisk character, one may escape it using backslash ().

In some cases it's not possible to always fix the interface name used by Docker, like for instance when using docker-compose and build statements. When container images are built, docker-compose uses the default network which interface's name is typically docker0 and this cannot be changed.

If the user uses a custom network with a custom interface name for the 'live' containers (for instance mycustominterface), then it becomes non-trivial to write static firewall rules, as they have to work for both the build and the run phase which use different interface name as described above.

A workaround is to use what's described in the statement above (which comes from nft(8)), so pass a prefix like:

nftables::rules::docker_ce::docker_interface: 'docker*'

however that's a bit ugly as this forces users to use a pattern for their custom interfaces.

The task is to allow * as value for docker_interface which would simply remove the iifname and oifname statements from the rules as recommended above:

users are supposed to just skip those always matching expressions

Unfortunately, AFAIK, it's not possible to use regular expressions like: docker*|mycustomiface.

To discuss before implementing this change if it actually makes sense to remove the iifname and oifname statements. Perhaps we should turn $docker_interface into an array and duplicate rules so something like:

nftables::rules::docker_ce::docker_interface: ['docker*', 'mycustomiface']

would create separate rules for each interface (or pattern).

[nbarrientos]

It might be possible in "recent" versions of docker-compose to select the network at build time too so perhaps this change is not necessary anymore.

https://docs.docker.com/compose/compose-file/compose-file-v3/#network
https://docs.docker.com/compose/compose-file/compose-file-v2/#network

[traylenator]

Perhaps we should turn $docker_interface into an array and duplicate rules so something like:

Not sure the rules need to be duplicated. iifname supports a list itself.

iifname {"docker*", "mycustominterface" }

assuming the glob is still respected in there.