dstack-docker.cfg

CONFIG_BRIDGE=m
CONFIG_BRIDGE_NETFILTER=m
CONFIG_NETFILTER_XT_MATCH_IPVS=m

# nf_tables support (needed by modern iptables-nft backend)
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NFT_COMPAT=m
CONFIG_NFT_NAT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_CT=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_REJECT=m
CONFIG_NFT_REJECT_INET=m
CONFIG_NFT_HASH=m
CONFIG_BPF_SYSCALL=y
CONFIG_IP_VS=m
CONFIG_SECCOMP=y
CONFIG_SECCOMP_FILTER=y
CONFIG_SECURITY_SELINUX=y
CONFIG_VLAN_8021Q=y
CONFIG_BRIDGE_VLAN_FILTERING=y
CONFIG_XFRM=y
CONFIG_XFRM_USER=y
CONFIG_XFRM_ALGO=y
# Disable ESP transforms to mitigate DirtyFrag-style page-cache writes via esp4/esp6.
# Keep XFRM userspace support available for non-ESP networking features, but do
# not build the vulnerable ESP protocol handlers.
CONFIG_INET_ESP=n
CONFIG_INET6_ESP=n
CONFIG_XFRM_ESP=n

# RxRPC is not needed by dstack and is another DirtyFrag trigger path. Keep it
# disabled even if future kernel feature sets would otherwise enable it.
CONFIG_AF_RXRPC=n
CONFIG_RXKAD=n
CONFIG_NETFILTER_XT_MATCH_BPF=y
CONFIG_CRYPTO_SEQIV=y
CONFIG_IPVLAN=m
CONFIG_BTRFS_FS=m
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_CFS_BANDWIDTH=y
CONFIG_BRIDGE_NF_EBTABLES=y
CONFIG_NETFILTER_FAMILY_BRIDGE=y
CONFIG_VETH=y
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
CONFIG_VXLAN=y
CONFIG_CGROUP_BPF=y

# ipset support (required by kube-router network policy controller)
CONFIG_IP_SET=m
CONFIG_IP_SET_HASH_IP=m
CONFIG_IP_SET_HASH_NET=m
CONFIG_IP_SET_HASH_IPPORT=m
CONFIG_IP_SET_HASH_IPPORTIP=m
CONFIG_IP_SET_HASH_IPPORTNET=m
CONFIG_IP_SET_HASH_NETPORT=m
CONFIG_IP_SET_HASH_NETIFACE=m
CONFIG_IP_SET_BITMAP_IP=m
CONFIG_IP_SET_BITMAP_PORT=m
CONFIG_IP_SET_LIST_SET=m
CONFIG_NETFILTER_XT_SET=m
CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m

# BLK IO throttling support
CONFIG_BLK_CGROUP=y
CONFIG_BLK_DEV_THROTTLING=y
CONFIG_BLK_DEV_THROTTLING_LOW=y