I just learned: Docker edits firewall rules for you
geoff.tuxpup.com
I just learned: Docker edits firewall rules for you
1–10 of 126 posts
Re: I just learned: Docker edits firewall rules for you
#2Docker was not designed with security in mind, and on any host exposed to the internet a massive security risk because of this. Putting someone in the `docker` group is nearly equivalent to giving them root permissions.
K8s at least offers more fine-grained control over networking, between port range restrictions and having to enable a NodePort.
Re: I just learned: Docker edits firewall rules for you
#3While docker's port exposure should be more explicit, he should also mention that he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons.
If he'd bind the host port to localhost or put caddy in a container in the same vlan, it wouldn't have happened. From the blogpost I'm not even sure if he's aware of the binding option.
If you argue that a software shouldn't behave this way after being configured so explicitly, Archlinux not preconfiguring iptables to limit exposure like Debian or Ubuntu is worse, because it happens implicitly.
Re: I just learned: Docker edits firewall rules for you
#4The fact that ufw doesn't play well with iptables sounds like a good reason not to use it.
(Yes yes I know iptables is antiquated but they should still be compatible with each other at the kernel level)
Re: I just learned: Docker edits firewall rules for you
#5I can also note that I didn't find any supported way to prevent that from happening. So it's one thing to find out that docker edit firewall rules. It's another thing to build a proper set of firewall rules which will prevent incoming connections.
I came up with some rules including DOCKER-USER chain but I'd qualify them as hack relying on undocumented configuration. And I just have no idea how to configure firewalld because it puts another layer of complexity on top of iptables.
Re: I just learned: Docker edits firewall rules for you
#6The docs, always the first place to look: https://docs.docker.com/network/iptables/
Re: I just learned: Docker edits firewall rules for you
#7Remember UPnP? Good times.
Re: I just learned: Docker edits firewall rules for you
#8You can also add `iptables: false` to docker's daemon json and docker will stop messing with your iptables conf.
Re: I just learned: Docker edits firewall rules for you
#9[deleted]
Re: I just learned: Docker edits firewall rules for you
#10You can also add `iptables: false` to docker's daemon json and docker will stop messing with your iptables conf.
[deleted]