postfwd - docker support
Author: jpk
Keywords: postfwd, postfwd usage, postfwd manual, postfwd docker, docker, postfix, policy, policy delegation, firewall, postfix acl, postfix acls, pfwpolicy, postfw, restrictions, IT-Security, IT-Consulting, Jan, Peter, Kessler

## postfwd docker support

To run postfwd in a docker container you will need use at least version 1.36 of postfwd. You can use one of the pre-built images "postfwd/postfwd:stable" or "postfwd/postfwd:testing" from DockerHub or download the postfwd distibution and build the image by yourself.

### Quicknav

- Using a pre-built image
  - docker
  - docker-compose
- Building your own image
  - get postfwd docker files
  - docker
  - docker-compose
- Configure the container
  - available settings
  - docker
  - docker-compose

### Using a pre-built image

#### a.) docker

- Get the image:

      docker pull postfwd/postfwd:stable

- Execute a container based on that image:

      docker run -it postfwd/postfwd:stable

#### b.) docker-compose

- Create docker-compose.yml:

      version: '2'

      services:
        postfwd:
          image: postfwd/postfwd:stable
          restart: always
          ports:
            # Modify interface and port below if required!
            - 127.0.0.1:10040:10040

- Execute the container:

      docker-compose up

### Building your own image

#### Get the postfwd docker files

The files "Dockerfile" and "docker-compose.yml" which were used to build the images at DockerHub can be found within the "docker"-subfolder of the postfwd distribution. You can find it at:

- GitHub:

      git clone https://github.com/postfwd/postfwd --branch master --single-branch postfwd

- postfwd.org:

      wget https://postfwd.org/postfwd-latest.tar.gz && gzip -dc postfwd-latest.tar.gz | tar -xf - && rm postfwd-latest.tar.gz

#### a.) docker

- Edit the Dockerfile and build the image:

      docker build --no-cache --pull -t postfwd:stable .

- Execute a container based on that image:

      docker run -it postfwd:stable

#### b.) docker-compose

- Edit the Dockerfile and the docker-compose.yml file and build the image:

      docker-compose build --no-cache --pull

- Execute the container:

      docker-compose up

### Configure the container

For reasonable operation you should configure postfwd. First you should create your own ruleset. Please look at the manpage or postfwd.org for more information on this topic. Save your ruleset to a file on the docker host - it will be further refered as:

-     /path/to/ruleset

Now specify the program options via the container environment. The following settings are available:

-     # use 'postfwd1' or 'postfwd2' to switch between versions
      # go to http://postfwd.org/versions.html for more info
      - PROG=postfwd1
      # port for postfwd
      - PORT=10040
      # configuration file
      - CONF=postfwd.cf
      # request cache in seconds. use '0' to disable
      - CACHE=60
      # additional arguments, see postfwd -h or man page for more
      - EXTRA=--no_parent_dns_cache --noidlestats --summary=600

#### a.) docker

- Run postfwd2 instead of postfwd1:

      docker run -v /path/to/ruleset:/etc/postfwd/postfwd.cf:ro -e PROG=postfwd2 -it postfwd:stable

- Disable request-cache, enable verbose logging:

      docker run -v /path/to/ruleset:/etc/postfwd/postfwd.cf:ro -e CACHE=0 -e EXTRA="-v" -it postfwd:stable

#### b.) docker-compose

- Run postfwd2 instead of postfwd1, disable cache, enable verbose logging (docker-compose.yml):

      #
      # docker-compose.yml
      #

      version: '2'

      services:

        postfwd:
          image: postfwd/postfwd:stable
          environment:
            - PROG=postfwd2
            - CACHE=0
            - EXTRA=-vv --no_parent_dns_cache --noidlestats --summary=600
          restart: always
          ports:
            - 127.0.0.1:10040:10040
          volumes:
            - /path/to/ruleset:/etc/postfwd/postfwd.cf:ro