ferm_docker_post.sh

#!/bin/bash
# ran vi @hook post

DOCKER_RULES_DIR=/tmp/ferm

for table in ${DOCKER_RULES_DIR}/*; do
  iptables-restore -n ${table}
done

ferm_docker_pre.sh

#!/bin/bash
# ran via cron

DOCKER_RULES_DIR=/tmp/ferm

TABLES="nat filter"
CHAINS="DOCKER CATTLE_PREROUTING CATTLE_POSTROUTING DOCKER-ISOLATION CATTLE_FORWARD"

mkdir ${DOCKER_RULES_DIR} > /dev/null 2>&1

for table in ${TABLES}; do
  echo "*${table}" > ${DOCKER_RULES_DIR}/${table}
  for chain in ${CHAINS}; do
    echo ":${chain} - [0:0]" >> ${DOCKER_RULES_DIR}/${table}
    iptables -S ${chain} -t ${table} >> ${DOCKER_RULES_DIR}/${table}
  done
  echo "COMMIT" >> ${DOCKER_RULES_DIR}/${table}
done