From adecaeb40b23b8ca51af1c8741e728f2d543a4ae Mon Sep 17 00:00:00 2001
From: Michael Crosby <crosby.michael@gmail.com>
Date: Mon, 16 Sep 2013 22:48:30 +0000
Subject: [PATCH] Prevent inter-container communication

---
 network.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/network.go b/network.go
index 84354b5c4..71742e364 100644
--- a/network.go
+++ b/network.go
@@ -170,6 +170,10 @@ func CreateBridgeIface(config *DaemonConfig) error {
 			"!", "-d", ifaceAddr, "-j", "MASQUERADE"); err != nil {
 			return fmt.Errorf("Unable to enable network bridge NAT: %s", err)
 		}
+		// Prevent inter-container communication by default
+		if err := iptables.Raw("-A", "FORWARD", "-i", config.BridgeIface, "-o", config.BridgeIface, "-j", "DROP"); err != nil {
+			return fmt.Errorf("Unable to prevent intercontainer communication: %s", err)
+		}
 	}
 	return nil
 }