The Container Firewall API manages ingress (inbound) and egress (outbound) firewall rules for individual containers. Use these endpoints to list, add, toggle, or remove rules, or to reset the firewall back to an open state. All rule changes are subject to per-container limits on rule count and serialized size, surfaced in the list response as rule_count, byte_count, max_rules, and max_bytes.
"message":"This container has reached its firewall rule limit.",
"data":{
"field":"container_firewall_rule_limit",
"container_id":"507f1f77bcf86cd799439011",
"server_id":"507f1f77bcf86cd799439022",
"current_count":500,
"limit":500
}
}
Error Code
Title
Description
Resolution
CONTAINER_FIREWALL_RULE_LIMIT
Container firewall rule limit reached
The container already holds the maximum number of firewall rules allowed (ingress and egress counted together). The applicable limit is returned as max_rules when listing firewall rules.
Remove an existing firewall rule on this container before adding a new one.
CONTAINER_FIREWALL_BYTES_LIMIT
Container firewall rule size limit reached
The container’s firewall rules have reached their total serialized size budget. This can be hit below the rule-count limit when individual rules are large (long descriptions or address lists). The applicable limit is returned as max_bytes when listing firewall rules.
Remove rules, or shorten descriptions and address lists, before adding a new rule.
{
"statusCode":404,
"error":"Not Found",
"message":"Container not found"
}
{
"statusCode":503,
"error":"FIREWALL_INVENTORY_UNAVAILABLE",
"message":"Unable to verify this container's firewall rules. No changes were made.",
"data":{
"field":"firewall_inventory",
"container_id":"507f1f77bcf86cd799439011"
}
}
Error Code
Title
Description
Resolution
FIREWALL_INVENTORY_UNAVAILABLE
Firewall inventory unavailable
The container’s live firewall rule list could not be established (host unreachable, or a malformed response), so the rule limit could not be evaluated. The request fails closed: no rule was added.
Retry shortly. If it persists, the hosting server may be unreachable.
"message":"This container has reached its firewall rule limit.",
"data":{
"field":"container_firewall_rule_limit",
"container_id":"507f1f77bcf86cd799439011",
"server_id":"507f1f77bcf86cd799439022",
"current_count":500,
"limit":500
}
}
Error Code
Title
Description
Resolution
CONTAINER_FIREWALL_RULE_LIMIT
Container firewall rule limit reached
The container already holds the maximum number of firewall rules allowed (ingress and egress counted together). The applicable limit is returned as max_rules when listing firewall rules.
Remove an existing firewall rule on this container before adding a new one.
CONTAINER_FIREWALL_BYTES_LIMIT
Container firewall rule size limit reached
The container’s firewall rules have reached their total serialized size budget. This can be hit below the rule-count limit when individual rules are large (long descriptions or address lists). The applicable limit is returned as max_bytes when listing firewall rules.
Remove rules, or shorten descriptions and address lists, before adding a new rule.
{
"statusCode":404,
"error":"Not Found",
"message":"Container not found"
}
{
"statusCode":503,
"error":"FIREWALL_INVENTORY_UNAVAILABLE",
"message":"Unable to verify this container's firewall rules. No changes were made.",
"data":{
"field":"firewall_inventory",
"container_id":"507f1f77bcf86cd799439011"
}
}
Error Code
Title
Description
Resolution
FIREWALL_INVENTORY_UNAVAILABLE
Firewall inventory unavailable
The container’s live firewall rule list could not be established (host unreachable, or a malformed response), so the rule limit could not be evaluated. The request fails closed: no rule was added.
Retry shortly. If it persists, the hosting server may be unreachable.
Flip a rule’s state between enabled and disabled without deleting it. Provide filter fields to identify which rule to toggle. The matching rule is then updated in place.
Delete rules from a container’s firewall. Unlike reset, this only removes matching rules and leaves the firewall ACL attached to the container’s bridge. Set all: true to remove every matching rule; omit all to remove only the first match.
Detach the firewall ACL from the container’s bridge, returning the container to an open state. Use this for a full firewall reset; for targeted rule removal, use the DELETE endpoints above instead.
