Primarily a iptables based firewall script, packaged with the required binaries for environments where iptables-restore is not present.
Articles that inspired this solution
Assuming the desired file with the output from iptables-restore is located at /etc/iptables/state
docker run \ --rm \ --cap-add=NET_ADMIN \ --net=host \ -v /etc/iptables:/host/etc/iptables:ro \ capybara1/firewall:1.0write_files: - path: /etc/iptables/state permissions: "0400" owner: "root:root" content: | #insert output of iptables-save here rancher: services: firewall: image: capybara1/firewall:latest net: host cap_add: - NET_ADMIN volumes: - /etc/iptables:/host/etc/iptables:ro labels: io.rancher.os.after: wait-for-network, console io.rancher.os.detach: "false" io.rancher.os.remove: "true"