Security Center provides the container firewall feature. The feature delivers firewall capabilities to protect containers. If attackers exploit vulnerabilities or malicious images to intrude into clusters, the container firewall feature generates alerts or blocks attacks on containers.
Limits
Only the Ultimate edition of Security Center supports this feature. For more information about how to purchase and upgrade Security Center, see Purchase Security Center and Upgrade and downgrade Security Center.
How container firewall works
In the container firewall module, network objects are used to identify container applications. The information about a network object includes the namespace to which a container application belongs, the name of the container application, the image of the container application, and the labels of the container application. You can create a defense rule to protect a cluster based on network objects. The defense rule can detect and block unusual traffic that is destined for the cluster. For more information about how to configure and use the container firewall feature, see Create a network object, Create a defense rule, Manage the defense status and defense rules of a cluster, and View details on the Protection status tab.
Supported operating system versions
A cluster defense rule can be enabled based on the AliNet plug-in. The AliNet plug-in is used to block malicious network behavior such as suspicious network connections, Domain Name System (DNS) hijacking, and brute-force attacks. Before you use the container firewall feature, make sure that your cluster nodes run an operating system whose kernel version is supported by the AliNet plug-in. If your cluster nodes run an operating system whose kernel version is not supported by the AliNet plug-in, the defense rule that you create for your cluster does not take effect. The following table describes the versions and kernel versions of the operating systems that are supported by the container firewall feature.
Operating system | Kernel version |
CentOS | |
Alibaba Cloud Linux (64-bit) |