"""
Some wheezy templates.
"""

docker = """\
@require(cidr, interface, containers)
domain ip {
    table nat {
        chain DOCKER;
        chain PREROUTING {
            policy ACCEPT;
            mod addrtype dst-type LOCAL jump DOCKER;
        }
        chain OUTPUT {
            policy ACCEPT;
            daddr ! 127.0.0.0/8 mod addrtype dst-type LOCAL jump DOCKER;
        }
        chain POSTROUTING {
            policy ACCEPT;
            saddr @cidr outerface ! @interface MASQUERADE;
        }
    }
    table filter {
        chain DOCKER;
        chain DOCKER-ISOLATION;
        chain FORWARD {
            jump DOCKER-ISOLATION;

            outerface @interface {
                jump DOCKER;
                mod conntrack ctstate (RELATED ESTABLISHED) ACCEPT;
            }
            interface @interface {
                outerface ! @interface ACCEPT;
                outerface @interface ACCEPT;
            }
        }
        chain DOCKER-ISOLATION {
            jump RETURN;
        }
    }

    # container setup
    @for container in containers:
    # @container['Id']
    @(
        networks = container['NetworkSettings']['Networks'].keys()
        first_network = list(networks)[0]
        # TODO: Loop over each network instad just using the first network!
        ip_address = container['NetworkSettings']['Networks'][first_network]['IPAddress']
        port_bindings = container['HostConfig']['PortBindings']

        # group into proto:port:(host:port)
        bindings = {}
        for port_proto, binds in port_bindings.iteritems():
            port, proto = port_proto.split("/")

            if proto not in bindings:
                bindings[proto] = {}

            if port not in bindings[proto]:
                bindings[proto][port] = []

            for bind in binds:
                bindings[proto][port].append((bind['HostIp'], bind['HostPort']))

    )
    table nat {
        chain POSTROUTING {
            # container setup
            @for proto, ports in bindings.iteritems():
            @for port, binds in ports.iteritems():
            saddr @ip_address/32 daddr @ip_address/32 protocol @proto {
                dport @port MASQUERADE;
            }
            @end
            @end
        }
        chain DOCKER {
            @for proto, ports in bindings.iteritems():
            @for port, binds in ports.iteritems():
            @for host_ip, host_port in binds:
            @{ host_ip and "daddr %s/32 " % host_ip or '' }interface ! @interface protocol tcp dport @host_port DNAT to @ip_address:@port;
            @end
            @end
            @end
        }
    }
    table filter {
        chain DOCKER {
            @for proto, ports in bindings.iteritems():
            daddr @ip_address/32 interface ! @interface outerface @interface protocol @proto {
            @for port, binds in ports.iteritems():
                dport @port ACCEPT;
            @end
            }
            @end
        }
    }
    @end
}
"""

@@ -1504,16 +1504,54 @@
 gs = %7B%7D%0A
+        if port_bindings != None:%0A    
         
@@ -1594,32 +1594,36 @@
 gs.iteritems():%0A
+    
             port
@@ -1663,24 +1663,28 @@
             
+    
 if proto not
@@ -1697,16 +1697,20 @@
 ndings:%0A
+    
         
@@ -1747,24 +1747,28 @@
             
+    
 if port not 
@@ -1787,16 +1787,20 @@
 proto%5D:%0A
+    
         
@@ -1843,24 +1843,28 @@
             
+    
 for bind in 
@@ -1862,32 +1862,36 @@
  bind in binds:%0A
+    
                 

Fix templates for containers without port bindings