Docker router lab

install_bleachwrt_docker_centos7.sh

Overwrites the saved network/env and systemd unit, enables IPv4 forwarding and promiscuous mode, restarts Docker, and replaces the named container/network on service start. This is not a general production router recommendation.

One-liner

curl -fL 'https://www.helper.sh/install_bleachwrt_docker_centos7.sh' -o './install_bleachwrt_docker_centos7.sh'

This command downloads the bundled file only; it does not run it. Inspect the saved source and compare its version before deciding whether to execute it.

Raw file

Download script for review Raw script

Derived from local repository

Check the file you downloaded

Compare a saved file with the exact bytes bundled in this page’s build. The file stays in this tab; this tool does not upload or persist it. Maximum 2 MiB.

Expected SHA-256
a832695d02b75ba95d25c2ed99fd13c482c4a991f036ac2f6a480eb9a6216739

Bundled byte count: 7831

Save checksum file

Save the script and checksum in the same directory. On Linux with GNU Coreutils, the command below checks the saved bytes only; it does not run the script. Keep the original filename for this command.

sha256sum --check './install_bleachwrt_docker_centos7.sh.sha256'

No comparison yet.

Selected file SHA-256

The checksum and script come from the same site, not an independent signature. A match does not prove safety, authenticity of upstream dependencies, or suitability for your host. Mutable remote dependencies need separate review.

Read validation and limitations

Requirements

Rootful Linux Docker, CentOS 7/yum/systemd and a LAN that permits multiple MAC addresses. Not Docker Desktop or rootless Docker.
Reserve both container and shim IPs. The generated OpenWrt netmask is fixed at 255.255.255.0 even if SUBNET changes.

Best for

Review an inherited macvlan lab before maintaining or retiring it.

Highlights

Defaults: bleachwrt/mini:latest; /opt/bleachwrt/openwrt-config; bleachwrt.service; macvlan-shim. The image tag is mutable.
Accepts --yes and --no-install-docker; environment controls include IFACE, CONTAINER_IP, SUBNET, GATEWAY, SHIM_IP and IMAGE. No dry-run.

Recommended procedure

Inspect the source, addresses, existing service/unit/config and other Docker workloads before any authorized change.
Read-only: systemctl cat bleachwrt; docker inspect bleachwrt; docker network inspect bleachwrt_macvlan; ip -d link show macvlan-shim; ip route; sysctl net.ipv4.ip_forward.
A running container does not prove LAN routing, management authentication or DNS/DHCP correctness. If unreachable, inspect unit/logs and switch MAC policy before retrying.

Safety notes

CentOS 7 is end-of-life. No real network, router or container test was run in this review.
No automatic backup/rollback of overwritten router config, unit or /etc/sysctl.conf. A restart can remove existing same-name resources and interrupt other containers.
No host -p mapping. Review LAN management ports 80/443/22 and optional DNS/DHCP 53/67/68 at the container IP; do not infer that the script configures access controls.

Docker services: check the interface and retained state

Choose by protocol, data directory and replacement impact: HTTP, SQL, cache, FastCGI or an image-baked application.

Open topic