Can we restrict inter-container communication?

[alpana17]

There is a feature in doxker.
By default, unrestricted network traffic is enabled between all containers on the same host on the default network bridge. Thus, each container has the potential of reading all packets across the container network on the same host. This might lead to an unintended and unwanted disclosure of information to other containers.
Using "icc": false in docker daemon file, we can restrict it in docker

Is there something similar for CRI-O as well?

@saschagrunert please suggest

[haircommander]

this is the responsibility of the CNI plugin. there are a variety to choose from that can provide what you're looking for

[alpana17]

@haircommander Please share a few here.
Do I need to install CNI plugin?
Also provide the document where these options are described in crio config

[haircommander]

Yeah the cri-o package sometimes installs cni plugins but doesn't need to. They're often deployed as daemonsets on each node to provide more features that coordinate with the kube-api. The options in the cri-o config are only restricted to where the plugins and configurations live. For more information, I would research more about different CNI plugins https://www.cni.dev/ It's not really my area of expertise so I don't feel qualified to advise