Other solution is to simply not expose ports directly with rocket compose and instead use something like Traefik to proxy them.
I’ve stopped using ports after having a redis instance taken over by some crypto miner.
I just learned: Docker edits firewall rules for you
11–20 of 126 posts
Re: I just learned: Docker edits firewall rules for you
#12The fact that ufw doesn't play well with iptables sounds like a good reason not to use it. (Yes yes I know iptables is antiquated but they should still be compatible with each other at the kernel level)
UFW works fine with iptables. The issue occurs because docker adds an iptables chain that takes precedence over the UFW rules.
Re: I just learned: Docker edits firewall rules for you
#13The fact that ufw doesn't play well with iptables sounds like a good reason not to use it. (Yes yes I know iptables is antiquated but they should still be compatible with each other at the kernel level)
UFW works fine with iptables. The issue occurs because docker adds an iptables chain that takes precedence over the UFW rules.
If ufw worked fine, they shouldn't have had to run "iptables -L" to find out that docker put in a rule that "ufw status" couldn't see. The commands should just be interchangeable.
Re: I just learned: Docker edits firewall rules for you
#14Why does Docker have the privilege of editing the iptables? Is it running as root?
Re: I just learned: Docker edits firewall rules for you
#15Why does Docker have the privilege of editing the iptables? Is it running as root?
Yes, the docker daemon runs as root
Re: I just learned: Docker edits firewall rules for you
#16it also fiddles with your container's resolv.conf, which can cock stuff up really badly if you are using search domain.
Re: I just learned: Docker edits firewall rules for you
#17While docker's port exposure should be more explicit, he should also mention that he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons. If he'd bind the host port to localhost or put caddy in a container in the same vlan, it wouldn't have happened. From the blogpost I'm not even sure if he's aware of the binding option. If you…
Considering how aggressively docker has been pushed down peoples' throats over the past 10 years, from bootcamps to tutorial after tutorial teaching how to use docker... it seems pretty unreasonable to think that everybody is going to read the all of the docker docs that describe this problem. Considering the risks involved, it's frankly silly for them not to include a warning.
Hell, in the "container networking" docs, it even says it doesn't: "By default, when you create or run a container using docker create or docker run, the container doesn’t expose any of it’s ports to the outside world."
And archlinux not preconfiguring iptables is a very, very archlinux-y thing to do -- not sure what your point on that is supposed to be there.
Re: I just learned: Docker edits firewall rules for you
#18Earlier quoted context omitted.
UFW works fine with iptables. The issue occurs because docker adds an iptables chain that takes precedence over the UFW rules.
If ufw worked fine, they shouldn't have had to run "iptables -L" to find out that docker put in a rule that "ufw status" couldn't see. The commands should just be interchangeable.
UFW works by creating iptables rules. It intentionally does not expose the full functionality of iptables. The u is for "uncomplicated". The fact that you can add iptables chains that take precedence over the UFW managed chain is a feature of iptables, not a bug of UFW. You'll find the same is true of any Linux firewall that sits on top of iptables or nftables.
Re: I just learned: Docker edits firewall rules for you
#19It is a long standing issue and is a gotcha for everyone.
https://github.com/moby/moby/issues/22054
It's completely asinine.
Re: I just learned: Docker edits firewall rules for you
#20Docker was not designed with security in mind, and on any host exposed to the internet a massive security risk because of this. Putting someone in the `docker` group is nearly equivalent to giving them root permissions. K8s at least offers more fine-grained control over networking, between port range restrictions and having to enable a NodePort.
s/nearly//
From https://zwischenzugs.com/2015/06/24/the-most-pointless-docke... anyone with Docker access gets root with that command.
TBH out of the box Kubernetes is as bad, or worse than docker, in that anyone with create pod permissions can get root on every worker node in the cluster (and the control plane nodes if it's unmanaged Kubernetes) https://raesene.github.io/blog/2019/04/01/The-most-pointless...