From ed562a7057c6fc9e42aca9d40ef1dafaf9a6a1ee Mon Sep 17 00:00:00 2001
From: 2b <2b@users.noreply.github.com>
Date: Sat, 30 Oct 2021 11:56:32 +0300
Subject: [PATCH] docs(fail2ban): Add info about running in rootless containers
 (#2252)

Co-authored-by: Brennan Kinney <5098581+polarathene@users.noreply.github.com>
---
 docs/content/config/security/fail2ban.md | 58 ++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/docs/content/config/security/fail2ban.md b/docs/content/config/security/fail2ban.md
index 402024a9..4d7852a6 100644
--- a/docs/content/config/security/fail2ban.md
+++ b/docs/content/config/security/fail2ban.md
@@ -48,6 +48,58 @@ t initialize iptables table `filter': Permission denied (you must be root)\nPerh
 j f2b-postfix
 ```
 
+## Running fail2ban in a rootless container
+
+[`RootlessKit`][rootless::rootless-kit] is the _fakeroot_ implementation for supporting _rootless mode_ in Docker and Podman. By default RootlessKit uses the [`builtin` port forwarding driver][rootless::port-drivers], which does not propagate source IP addresses.
+
+It is necessary for `fail2ban` to have access to the real source IP addresses in order to correctly identify clients. This is achieved by changing the port forwarding driver to [`slirp4netns`][rootless::slirp4netns], which is slower than `builtin` but does preserve the real source IPs.
+
+### Docker with `slirp4netns` port driver
+
+For [rootless mode][rootless::docker] in Docker, create `~/.config/systemd/user/docker.service.d/override.conf` with the following content:
+
+```
+[Service]
+Environment="DOCKERD_ROOTLESS_ROOTLESSKIT_PORT_DRIVER=slirp4netns"
+```
+
+And then restart the daemon:
+
+```console
+$ systemctl --user daemon-reload
+$ systemctl --user restart docker
+```
+
+!!! note
+
+    This changes the port driver for all rootless containers managed by Docker.
+
+    Per container configuration is not supported, if you need that consider Podman instead.
+
+### Podman with `slirp4netns` port driver
+
+[Rootless Podman][rootless::podman] requires adding the value `slirp4netns:port_handler=slirp4netns` to the `--network` CLI option, or `network_mode` setting in your `docker-compose.yml`.
+
+
+You must also add the ENV `NETWORK_INTERFACE=tap0`, because Podman uses a [hard-coded interface name][rootless::podman::interface] for `slirp4netns`.
+
+
+!!! example
+
+    ```yaml
+    services:
+      mailserver:
+        network_mode: "slirp4netns:port_handler=slirp4netns"
+        environment:
+          - ENABLE_FAIL2BAN=1
+          - NETWORK_INTERFACE=tap0
+          ...
+    ```
+
+!!! note
+
+    `slirp4netns` is not compatible with user-defined networks.
+
 ## Manage bans
 
 You can also manage and list the banned IPs with the [`setup.sh`][docs-setupsh] script.
@@ -69,3 +121,9 @@ Here `192.168.1.15` is our banned IP.
 [docs-setupsh]: ../setup.sh.md
 [github-file-f2bjail]: https://github.com/docker-mailserver/docker-mailserver/blob/master/config/fail2ban-jail.cf
 [github-file-f2bconfig]: https://github.com/docker-mailserver/docker-mailserver/blob/master/config/fail2ban-fail2ban.cf
+[rootless::rootless-kit]: https://github.com/rootless-containers/rootlesskit
+[rootless::port-drivers]: https://github.com/rootless-containers/rootlesskit/blob/v0.14.5/docs/port.md#port-drivers
+[rootless::slirp4netns]: https://github.com/rootless-containers/slirp4netns
+[rootless::docker]: https://docs.docker.com/engine/security/rootless
+[rootless:podman]: https://github.com/containers/podman/blob/v3.4.1/docs/source/markdown/podman-run.1.md#--networkmode---net
+[rootless:podman::interface]: https://github.com/containers/podman/blob/v3.4.1/libpod/networking_slirp4netns.go#L264