packages/utils/docker-ce, branch master

docker-ce: docker-ce -> dockerd

2020-12-15T12:52:33Z

The source is being deprecated and split into the CLI and engine/daemon repositories, So `docker-ce` will now be the `dockerd` and a separate package will be made for the `docker` CLI. Signed-off-by: Gerard Ryan

docker-ce: Added firewall.extra_iptables_args

2020-11-30T08:59:34Z

This is a convenience argument to primarily facilitate outbound wan connections from a docker container. However, all docker containers can't bidirectionally communicate with the internet by default. Signed-off-by: Gerard Ryan

docker-ce: Normalized variable dereference style

2020-11-30T08:57:30Z

Signed-off-by: Gerard Ryan

docker-ce: update PKG_RELEASE version

2020-11-19T13:20:15Z

Signed-off-by: Florian Eckert

docker-ce: do not delete generated iptables by docker-ce

2020-11-19T13:20:12Z

Deleting rules that docker has created is error-prone, because with every update docker we have to check if anything has changed. Cleaning up the firewall rules is part of the docker and should and must be cleaned up and handeled by them when the service is terminated. Signed-off-by: Florian Eckert

docker-ce: add device option to expand interface blocking

2020-11-19T13:20:09Z

If docker-ce handles the firewall and fw3 is not envolved because the rules get not proceed, then not only docker0 should be handled but also other interfaces and therefore other docker networks. This commit extends the handling and introduces a new uci option `device` in the docker config firewall section. This can be used to specify which device is allowed to access the container. Up to now only docker0 is covert. Signed-off-by: Florian Eckert

docker-ce: remove not applicable uciupdate

2020-11-19T13:20:07Z

As the protocol is set to none, this makes no sense here, as it cannot be controlled and thus processed by the netifd. Signed-off-by: Florian Eckert

docker-ce: set proto for docker bridge device to none

2020-11-19T13:20:04Z

Set proto from `static` to `none`. This makes it clear that this interface is not handled by the netifd. Signed-off-by: Florian Eckert

docker-ce: make docker-ce firewall handling configurable

2020-11-19T13:20:02Z

Openwrt has a own firewall service called fw3, that supports firewall zones. Docker can bypass the handling of the zone rules in openwrt via custom tables. These are "always" processed before the openwrt firewall. Which is prone to errors! Since not everyone is aware that the firewall of openwrt will not be passed. And this is a security problem because a mapped port is visible on all interfaces and so also on the WAN side. If the firewall handling in docker is switched off, then the port in fw3 must be explicitly released and it cannot happen that the port is accidentally exported to the outside world via the interfaces on the WAN zone. So all rules for the containers should and so must be made in fw3. Signed-off-by: Florian Eckert

docker-ce: add arguments call to uciadd and ucidel

2020-11-19T13:19:59Z

Up to now only the docker0 interface and bridge is created by default. In order to create other interfaces and to integrate them into the openwrt these functions can now be called with arguments. Signed-off-by: Florian Eckert