The docs, always the first place to look: https://docs.docker.com/network/iptables/
I just learned: Docker edits firewall rules for you
41–50 of 126 posts
Re: I just learned: Docker edits firewall rules for you
#42How else would you expect it to NAT traffic into and out of the containers' network namespaces?
Re: I just learned: Docker edits firewall rules for you
#43Earlier quoted context omitted.
UFW works by creating iptables rules. It intentionally does not expose the full functionality of iptables. The u is for "uncomplicated". The fact that you can add iptables chains that take precedence over the UFW managed chain is a feature of iptables, not a bug of UFW. You'll find the same is true of any Linux firewall that sits on top of iptables or nftables.
Could UFW detect/warn that there are iptables rules interfering with its own rules?
That's a good question actually. Given the complexity and power of iptables and nftables (which is the reason UFW, firewalld and the like exist) I'd guess probably not. Trying to determine if a rule on another chain (or really a combination of rules across a combination of chains) changes the behavior of one of yours would be... challenging. I suspect the best it could do reliably is detect that rules in other chains exist and warn about that, but that's also a pretty common case. Pretty much every VPS in a cloud would have this warning for example.
Personally I think the real problem here is docker. Injecting rules into iptables is a bit like blindly injecting lines of code into someone else's program sight unseen. I'm not aware of any other tools that are nearly so willing to do so.
Re: I just learned: Docker edits firewall rules for you
#44Earlier quoted context omitted.
If something is designed and marketed as being usable without reading docs, it'd damn well better have defaults that "First, do no harm." It's insane to build something that optimizes ease of use, and then require users to understand it in depth to avoid footgunning.
By default, Docker containers are not exposed to the host's public interface. You must explicitly expose them. If you expose everything else too, that's no-one's fault but yours.
Just about everyone who describes Docker, including the Docker documentation itself, describes "exposing" a port as creating a "mapping" between ports in the container and ports on the host.
Furthermore, the "container networking" page (https://docs.docker.com/config/containers/container-networki...) says that Docker creates iptables rules for the purpose of creating this mapping.
The clear implication is that, say, "exposing" port 8080 should have similar behavior to simply running a program on the host that listens on port 8080. It does do that, but it also silently punches holes in your firewall, unless you make Docker-specific changes to your firewall config to work around it.
Even if a knowledgeable person reads the docs, and then sees something like "click here for the platform-specific details of how iptables rules are managed", I think it's entirely reasonable for them not to realize that those platform-specific details are in fact security-critical.
Re: I just learned: Docker edits firewall rules for you
#45Use podman and ditch docker, you can even alias it.
Re: I just learned: Docker edits firewall rules for you
#46Earlier quoted context omitted.
It doesn’t say that it doesn’t do that, it says that it doesn’t do that by default. If you explicitly tell it to expose a port, how can you possibly be surprised when it does so? If you don’t read the docs you don’t get to complain when you don’t understand the behavior. Edit: the second paragraph on the first search result for “docker networking” says that because it’s trying to present things in a platform independ…
If something is designed and marketed as being usable without reading docs, it'd damn well better have defaults that "First, do no harm." It's insane to build something that optimizes ease of use, and then require users to understand it in depth to avoid footgunning.
Docker is certainly not marketed that way & even the majority of tutorials / if not all on Digital ocean or similar sites don't misguide you into doing this. It is clearly not marketed as "usable without reading docs" and even though people using it as a tool to deploy prebuilt software without learning its configuration, this doesn't apply to the docker commands itself.
If https://www.portainer.io/ would do this implicitly, your argument would be more valid. But for the docker command-line it's a bit too far-fetched.
Re: I just learned: Docker edits firewall rules for you
#47Earlier quoted context omitted.
What's asinine is "I configured it wrong and it broke, it's a bug in docker".
Maybe inform yourself of the situation and consider again carefully. Should all programs running as root bypass a firewall explicitly configured by the user?
Not by default, but if you explicitly pass them a command-line flag that means "open this port to the network" then they should.
Re: I just learned: Docker edits firewall rules for you
#48I learned this a few months ago too. It's such a weird, stupid system. But everyone seems to think this is pretty normal. I think the firewall is my business, and nothing else should automatically open ports in it. Especially not docker.
Yep, learned that the hard way when it trashed my server UFW config as well. It felt kinda wierd to have a tool change machine configuration in such a way (even VMs generally don't do that?), but what do I know, I still prefer to deploy single binary services.
Re: I just learned: Docker edits firewall rules for you
#49While docker's port exposure should be more explicit, he should also mention that he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons. If he'd bind the host port to localhost or put caddy in a container in the same vlan, it wouldn't have happened. From the blogpost I'm not even sure if he's aware of the binding option. If you…
> he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons Same thing 90% of people do.
If you mean people that install Docker as an "app" on their NAS, they most likely use portainer and don't run into this issue. There are ways for people that don't want to learn the configuration of a project.
Re: I just learned: Docker edits firewall rules for you
#50Docker was not designed with security in mind, and on any host exposed to the internet a massive security risk because of this. Putting someone in the `docker` group is nearly equivalent to giving them root permissions. K8s at least offers more fine-grained control over networking, between port range restrictions and having to enable a NodePort.
The 1st thing only happens when users explicitly misconfigure docker, the other one is a real security problem when docker runs in root mode.