Syn flood and net.ipv4.tcp_syncookies

Question

I am trying to configure a Docker container, running tengine on Ubuntu 14, to use syncookies. However I am facing some issues.

The host has net.ipv4.tcp_syncookies=1 enabled and syncookies work directly on the host. But the container on the same host does not use syncookies.

Does anyone know a way of getting the container to use syncookies?

Thanks in advance :).

Answer 1

I suspect the default bridge will be missing a lot of customizations you make on the host network interface. Bypass the bridge completely and attach the container directly to the host network (not a good general practice, but your use case is atypical) with a:

docker run --network host ...