RouterOS version 7.1rc3 has been released in public “development” channel!
What’s new in 7.1rc3 (2021-Sep-08 13:29):
*) added IPSec hardware acceleration support for RB5009;
*) added support for running Docker ™ containers;
*) added Zerotier ™ support for ARM and ARM64;
*) fixed L2TP establishment (introduced in v7.1rc2);
*) fixed LDPv6;
*) functionality and stability improvements for L2TPv3;
*) VPLS stability improvements;
*) other minor fixes and improvements;
Container documentation is coming soon. Basic steps to get you started with experimentation:
1. Get Docker image as tar archive and copy to router (currently there is no 'pull' command in RouterOS, so containers should be exported from a working Docker environment). Also note that container's architecture should match with the router's.
-----------------------------------------------------
$ docker pull docker/example-container
$ docker save docker/example-container > my-container.tar
2. Add veth interface for the container
---------------------------------------
[admin@MikroTik] > /interface/veth/add name=veth1 address=172.17.0.2/16 gateway=172.17.0.1
3. Create bridge for containers and add veth to it
--------------------------------------------------
[admin@MikroTik] > /interface/bridge/add name=docker
[admin@MikroTik] > /ip/address/add address=172.17.0.1/16 interface=docker
[admin@MikroTik] > /interface/bridge/port add bridge=docker interface=veth1
4. Setup NAT for outgoing traffic
---------------------------------
[admin@MikroTik] > /ip/firewall/nat/add chain=srcnat action=masquerade src-address=172.17.0.0/16
5. Create environment variables for container if needed
-------------------------------------------------------
[admin@MikroTik] > /container/envs/add list=foo name=SECRET value=12345678
[admin@MikroTik] > /container/envs/add list=foo name=FOO value=bar
6. Define mounts if needed
--------------------------
[admin@MikroTik] > /container/mounts/add name=etc src=disk1/etc dst=/etc
[admin@MikroTik] > /container/mounts/add name=opt src=disk1/opt dst=/opt
If ``src`` directory does not exist on first time use then it will be populated
with whatever container have in ``dst`` location.
7. Create container from image tar
----------------------------------
[admin@MikroTik] > /container/add file=my-container.tar interface=veth1 envlist=foo root-dir=disk1/foo mounts=etc,opt
Use ``logging=yes`` to see container output in log with tags
``container,debug,info``.
8. Make sure container has been added and status is stopped
-----------------------------------------------------------
[admin@MikroTik] > container/print
9. Redirect port 8080 traffic to container
------------------------------------------
[admin@MikroTik] > /ip/firewall/nat/add chain=dstnat action=dst-nat to-addresses=172.17.0.2 to-ports=80 protocol=tcp dst-port=8080
10. Start container
-------------------
[admin@MikroTik] > /container/start 0
Already writed, but if your timezone is negative, this is ISO time:
ISO:8601 2021-09-08T10:29Z (GMT / UTC)
ISO:8601 2021-09-08T13:29+03:00 (Riga, Latvia / EEST Eastern European Summer Time)
ISO:8601 2021-09-08T15:59+05:30 (New Delhi, India / India)
Is the Docker support an optional package? I can’t imagine many people wanting this, and it introduces massive security implications especially for all those hacked routers.
Since privilege escalation is pretty much a given, can we also allow root SSH access to RouterOS directly now? Running a single binary is greatly preferred to running an entire container.
