Security Center provides the container firewall feature. The feature delivers firewall capabilities to protect containers. If attackers exploit vulnerabilities or malicious images to intrude into clusters, the container firewall feature generates alerts or blocks attacks on containers.
Limits
Only the Ultimate edition of Security Center supports this feature. For more information about how to purchase and upgrade Security Center, see Purchase Security Center and Upgrade and downgrade Security Center.
How container firewall works
In the container firewall module, network objects are used to identify container applications. The information about a network object includes the namespace to which a container application belongs, the name of the container application, the image of the container application, and the labels of the container application. You can create a defense rule to protect a cluster based on network objects. The defense rule can detect and block unusual traffic that is destined for the cluster.
If the interceptable status of a cluster is abnormal, you cannot enable defense for the cluster and the defense rule does not take effect. You must handle exceptions at the earliest opportunity. For more information, see Troubleshoot the issues causing the abnormal blocking status of a cluster.
Supported operating system versions
A cluster defense rule can be enabled based on the AliNet plug-in. The AliNet plug-in is used to block malicious network behavior such as suspicious network connections, Domain Name System (DNS) hijacking, and brute-force attacks. Before you use the container firewall feature, make sure that your cluster nodes run an operating system whose kernel version is supported by the AliNet plug-in. If your cluster nodes run an operating system whose kernel version is not supported by the AliNet plug-in, the defense rule that you create for your cluster does not take effect. The following table describes the operating systems and kernel versions of the operating systems that are supported by the container firewall feature.
Operating system | Kernel version |
CentOS | |
Alibaba Cloud Linux (64-bit) |
Procedure
To configure and use container firewall, perform the following steps:
Create a source network object and a destination network object. For more information, see Create a network object.
Create and enable a defense rule. For more information, see Create a defense rule.
Enable defense for a cluster. For more information, see Manage the defense status and defense rules of a cluster.
View alerts that are generated when a defense rule is triggered. For more information, see View details on the Protection Status tab.