Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I just learned: Docker edits firewall rules for you

geoff.tuxpup.com

Post reply on HN
Print view View original

31–40 of 126 posts

Re: I just learned: Docker edits firewall rules for you

#31

Post by 2OEH8eoCRo0 »

ethbr0 wrote: post #22
vbezhenar wrote: post #5

I can also note that I didn't find any supported way to prevent that from happening. So it's one thing to find out that docker edit firewall rules. It's another thing to build a proper set of firewall rules which will prevent incoming connections. I came up with some rules including DOCKER-USER chain but I'd qualify them as hack relying on undocumented configuration. And I just have no idea how to configure firewalld…

FYI, afaik firewalld as a high level interface is on the way out in RHEL* land (if that's what you're using), to be replaced by nftables.

firewalld is a high level interface to both nftables and iptables.

Re: I just learned: Docker edits firewall rules for you

#32

Post by Gordonjcp »

ethbr0 wrote: post #25
Godel_unicode wrote: post #21

Earlier quoted context omitted.

It doesn’t say that it doesn’t do that, it says that it doesn’t do that by default. If you explicitly tell it to expose a port, how can you possibly be surprised when it does so? If you don’t read the docs you don’t get to complain when you don’t understand the behavior. Edit: the second paragraph on the first search result for “docker networking” says that because it’s trying to present things in a platform independ…

If something is designed and marketed as being usable without reading docs, it'd damn well better have defaults that "First, do no harm." It's insane to build something that optimizes ease of use, and then require users to understand it in depth to avoid footgunning.

By default, Docker containers are not exposed to the host's public interface.

You must explicitly expose them.

If you expose everything else too, that's no-one's fault but yours.

Re: I just learned: Docker edits firewall rules for you

#33

Post by justinclift »

Gordonjcp wrote: post #27
ysleepy wrote: post #19

It is a long standing issue and is a gotcha for everyone. https://github.com/moby/moby/issues/22054 It's completely asinine.

What's asinine is "I configured it wrong and it broke, it's a bug in docker".

Docker's networking behaviour famously changes between point releases, sometimes without even being mentioned in the release notes.

Very much a case of "make sure you use some sort of overarching firewall solution" wrapping your Docker hosts, otherwise you can be in for a world of hurt. :/

Their support for IPv6 used to be extremely shitty too, with the documented switch to enable it... not working at all. Heh. ;)

The IPv6 thing may or may not be better now, but I haven't tried Docker with IPv6 in years so no idea.

Re: I just learned: Docker edits firewall rules for you

#34

Post by ysleepy »

Gordonjcp wrote: post #27
ysleepy wrote: post #19

It is a long standing issue and is a gotcha for everyone. https://github.com/moby/moby/issues/22054 It's completely asinine.

What's asinine is "I configured it wrong and it broke, it's a bug in docker".

Maybe inform yourself of the situation and consider again carefully.

Should all programs running as root bypass a firewall explicitly configured by the user?

Re: I just learned: Docker edits firewall rules for you

#35

Post by polotics »

Gordonjcp wrote: post #27
ysleepy wrote: post #19

It is a long standing issue and is a gotcha for everyone. https://github.com/moby/moby/issues/22054 It's completely asinine.

What's asinine is "I configured it wrong and it broke, it's a bug in docker".

The law of least-surprise disagrees with you I am afraid: firewall rule override is clearly stepping off the limits of what containerization should provoke.

Re: I just learned: Docker edits firewall rules for you

#37

Post by justinclift »

teekert wrote: post #29

Oh no I only expose ports on my tailnet. Or, I guess not then? How to check the status of the real firewall them, if ufw can mislead?

If you're legally allowed to run nmap against your host (eg some network places will have a real problem with it!) then it can be a useful way to check the "real world" reachability of ports.

Re: I just learned: Docker edits firewall rules for you

#38

Post by NotYourLawyer »

bionade24 wrote: post #3

While docker's port exposure should be more explicit, he should also mention that he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons. If he'd bind the host port to localhost or put caddy in a container in the same vlan, it wouldn't have happened. From the blogpost I'm not even sure if he's aware of the binding option. If you…

> he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons

Same thing 90% of people do.

Post reply on HN