Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I just learned: Docker edits firewall rules for you

geoff.tuxpup.com

Post reply on HN
Print view View original

21–30 of 126 posts

Re: I just learned: Docker edits firewall rules for you

#21

Post by Godel_unicode »

chaps wrote: post #17
bionade24 wrote: post #3

While docker's port exposure should be more explicit, he should also mention that he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons. If he'd bind the host port to localhost or put caddy in a container in the same vlan, it wouldn't have happened. From the blogpost I'm not even sure if he's aware of the binding option. If you…

Considering how aggressively docker has been pushed down peoples' throats over the past 10 years, from bootcamps to tutorial after tutorial teaching how to use docker... it seems pretty unreasonable to think that everybody is going to read the all of the docker docs that describe this problem. Considering the risks involved, it's frankly silly for them not to include a warning. Hell, in the "container networking" doc…

It doesn’t say that it doesn’t do that, it says that it doesn’t do that by default. If you explicitly tell it to expose a port, how can you possibly be surprised when it does so?

If you don’t read the docs you don’t get to complain when you don’t understand the behavior.

Edit: the second paragraph on the first search result for “docker networking” says that because it’s trying to present things in a platform independent way the overview won’t cover iptables specifics and then links to the detailed docs of how it uses iptables. If you can’t read two paragraphs maybe don’t try to be an engineer.

Re: I just learned: Docker edits firewall rules for you

#22

Post by ethbr0 »

vbezhenar wrote: post #5

I can also note that I didn't find any supported way to prevent that from happening. So it's one thing to find out that docker edit firewall rules. It's another thing to build a proper set of firewall rules which will prevent incoming connections. I came up with some rules including DOCKER-USER chain but I'd qualify them as hack relying on undocumented configuration. And I just have no idea how to configure firewalld…

FYI, afaik firewalld as a high level interface is on the way out in RHEL* land (if that's what you're using), to be replaced by nftables.

Re: I just learned: Docker edits firewall rules for you

#24

Post by lazka »

Volundr wrote: post #18
nubinetwork wrote: post #13

Earlier quoted context omitted.

If ufw worked fine, they shouldn't have had to run "iptables -L" to find out that docker put in a rule that "ufw status" couldn't see. The commands should just be interchangeable.

UFW works by creating iptables rules. It intentionally does not expose the full functionality of iptables. The u is for "uncomplicated". The fact that you can add iptables chains that take precedence over the UFW managed chain is a feature of iptables, not a bug of UFW. You'll find the same is true of any Linux firewall that sits on top of iptables or nftables.

Could UFW detect/warn that there are iptables rules interfering with its own rules?

Re: I just learned: Docker edits firewall rules for you

#25

Post by ethbr0 »

Godel_unicode wrote: post #21
chaps wrote: post #17

Earlier quoted context omitted.

Considering how aggressively docker has been pushed down peoples' throats over the past 10 years, from bootcamps to tutorial after tutorial teaching how to use docker... it seems pretty unreasonable to think that everybody is going to read the all of the docker docs that describe this problem. Considering the risks involved, it's frankly silly for them not to include a warning. Hell, in the "container networking" doc…

It doesn’t say that it doesn’t do that, it says that it doesn’t do that by default. If you explicitly tell it to expose a port, how can you possibly be surprised when it does so? If you don’t read the docs you don’t get to complain when you don’t understand the behavior. Edit: the second paragraph on the first search result for “docker networking” says that because it’s trying to present things in a platform independ…

If something is designed and marketed as being usable without reading docs, it'd damn well better have defaults that "First, do no harm."

It's insane to build something that optimizes ease of use, and then require users to understand it in depth to avoid footgunning.

Re: I just learned: Docker edits firewall rules for you

#28

Post by Godel_unicode »

ethbr0 wrote: post #25
Godel_unicode wrote: post #21

Earlier quoted context omitted.

It doesn’t say that it doesn’t do that, it says that it doesn’t do that by default. If you explicitly tell it to expose a port, how can you possibly be surprised when it does so? If you don’t read the docs you don’t get to complain when you don’t understand the behavior. Edit: the second paragraph on the first search result for “docker networking” says that because it’s trying to present things in a platform independ…

If something is designed and marketed as being usable without reading docs, it'd damn well better have defaults that "First, do no harm." It's insane to build something that optimizes ease of use, and then require users to understand it in depth to avoid footgunning.

Who is marketing it that way? That’s insane.

Re: I just learned: Docker edits firewall rules for you

#30

Post by Gordonjcp »

dawnerd wrote: post #11

Other solution is to simply not expose ports directly with rocket compose and instead use something like Traefik to proxy them. I’ve stopped using ports after having a redis instance taken over by some crypto miner.

Traefik is a good idea for other reasons, but there's no problem with using Docker to directly expose ports.

You just need to ensure that you're only exposing the *right* ports, and aren't just blindly opening everything up to the world.

By default nothing is exposed to the world. You do not need to expose your Redis server's port to anything.

Post reply on HN