Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I just learned: Docker edits firewall rules for you

geoff.tuxpup.com

Post reply on HN
Print view View original

51–60 of 126 posts

Re: I just learned: Docker edits firewall rules for you

#51

Post by izacus »

josephcsible wrote: post #47
ysleepy wrote: post #34

Earlier quoted context omitted.

Maybe inform yourself of the situation and consider again carefully. Should all programs running as root bypass a firewall explicitly configured by the user?

Not by default, but if you explicitly pass them a command-line flag that means "open this port to the network" then they should.

No they shouldn't, just how nginx shouldn't manipulate iptables just because you've said it should listen to 443 on "the network".

Many times you don't even want docker containers to go "to the network" directly and it shouldn't assume unsecure behaviour by default.

Moreover, CRITICALLY, you can't prevent Docker from doing that and you can ONLY secure the machine by adding another rule on top that supresses Dockers rule... and those dockers rule change over time making it easy for the blocking hack to stop working after an update and again make the machine unsecure.

Re: I just learned: Docker edits firewall rules for you

#52

Post by bionade24 »

KaiserPro wrote: post #16

it also fiddles with your container's resolv.conf, which can cock stuff up really badly if you are using search domain.

There is a option to hardcode DNS and also an option to don't abstract networking and use host mode. Fiddling with your container's resolv.conf is necessary for docker networks between containers.

Re: I just learned: Docker edits firewall rules for you

#53

Post by selfmodruntime »

ysleepy wrote: post #34
Gordonjcp wrote: post #27

Earlier quoted context omitted.

What's asinine is "I configured it wrong and it broke, it's a bug in docker".

Maybe inform yourself of the situation and consider again carefully. Should all programs running as root bypass a firewall explicitly configured by the user?

The real answer is that OP is using docker wrong. If you „publish“ a port, your firewall gets amended. This is clearly stated in the documentation. If you do not wish for that to happen, and instead want to use a reverse proxy, you „expose“ a port instead and reroute the requests into the docker bridge network.

Re: I just learned: Docker edits firewall rules for you

#54

Post by selfmodruntime »

izacus wrote: post #51
josephcsible wrote: post #47

Earlier quoted context omitted.

Not by default, but if you explicitly pass them a command-line flag that means "open this port to the network" then they should.

No they shouldn't, just how nginx shouldn't manipulate iptables just because you've said it should listen to 443 on "the network". Many times you don't even want docker containers to go "to the network" directly and it shouldn't assume unsecure behaviour by default. Moreover, CRITICALLY, you can't prevent Docker from doing that and you can ONLY secure the machine by adding another rule on top that supresses Dockers r…

You‘re wrong. If you use a command line argument that explicitely states „this will publish this port in your firewall for convenience“, a command line argument which you shouldn‘t use anyway, then you‘re on your own.

You choose to do this. Docker assumes that you know what you‘re doing.

You‘re also wrong in your last paragraph. There is the - easy - option to expose the port on your loopback, and re route to the docker bridge network by using a reverse proxy.

Re: I just learned: Docker edits firewall rules for you

#55

Post by bionade24 »

skerit wrote: post #36

I learned this a few months ago too. It's such a weird, stupid system. But everyone seems to think this is pretty normal. I think the firewall is my business, and nothing else should automatically open ports in it. Especially not docker.

This is not about being unnormal, this is a design decision. Just because people use docker in the "tradional admin way", too doesn't mean it's a wrong decision to do this. Wishful thinking about what a command of a software does without looking it up is generally dangerous. There are abstractions to help people that don't want to bother, e.g. portainer.

Re: I just learned: Docker edits firewall rules for you

#56

Post by selfmodruntime »

chaps wrote: post #17
bionade24 wrote: post #3

While docker's port exposure should be more explicit, he should also mention that he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons. If he'd bind the host port to localhost or put caddy in a container in the same vlan, it wouldn't have happened. From the blogpost I'm not even sure if he's aware of the binding option. If you…

Considering how aggressively docker has been pushed down peoples' throats over the past 10 years, from bootcamps to tutorial after tutorial teaching how to use docker... it seems pretty unreasonable to think that everybody is going to read the all of the docker docs that describe this problem. Considering the risks involved, it's frankly silly for them not to include a warning. Hell, in the "container networking" doc…

> By default, when you create or run a container using docker create or docker run, the container doesn’t expose any of it’s ports to the outside world.

It doesn't? You're explicitly telling it to do so and then go on crying about how docker is awful.

Re: I just learned: Docker edits firewall rules for you

#57

Post by selfmodruntime »

Godel_unicode wrote: post #28
ethbr0 wrote: post #25

Earlier quoted context omitted.

If something is designed and marketed as being usable without reading docs, it'd damn well better have defaults that "First, do no harm." It's insane to build something that optimizes ease of use, and then require users to understand it in depth to avoid footgunning.

Who is marketing it that way? That’s insane.

It really is. I am astonished by the simple mindedness of some people in this thread. Half knowledge really is dangerous.

Re: I just learned: Docker edits firewall rules for you

#58

Post by bionade24 »

izacus wrote: post #51
josephcsible wrote: post #47

Earlier quoted context omitted.

Not by default, but if you explicitly pass them a command-line flag that means "open this port to the network" then they should.

No they shouldn't, just how nginx shouldn't manipulate iptables just because you've said it should listen to 443 on "the network". Many times you don't even want docker containers to go "to the network" directly and it shouldn't assume unsecure behaviour by default. Moreover, CRITICALLY, you can't prevent Docker from doing that and you can ONLY secure the machine by adding another rule on top that supresses Dockers r…

You can prevent docker from doing that by editing its config, but you have to read the documentation to know that. As you have to, to actually know what a certain command does, too.

Re: I just learned: Docker edits firewall rules for you

#59

Post by selfmodruntime »

teraflop wrote: post #44
Gordonjcp wrote: post #32

Earlier quoted context omitted.

By default, Docker containers are not exposed to the host's public interface. You must explicitly expose them. If you expose everything else too, that's no-one's fault but yours.

Just about everyone who describes Docker, including the Docker documentation itself, describes "exposing" a port as creating a "mapping" between ports in the container and ports on the host. Furthermore, the "container networking" page ( https://docs.docker.com/config/containers/container-networki... ) says that Docker creates iptables rules for the purpose of creating this mapping. The clear implication is that, say…

No. This is not the case. There is a different term that does what you mean: "publishing" a port. It's different from the "EXPOSE XYZ" syntax, and is used in the docker cli with the "-p" command.

Re: I just learned: Docker edits firewall rules for you

#60

Post by bionade24 »

quectophoton wrote: post #23

I only learned about this a few years ago by coincidence, because I happened to open HN when there was a story[1] about NewsBlur having been hacked "thanks" to this Docker "feature". [1]: https://news.ycombinator.com/item?id=27670058

If such an obvious thing happens to a company because they're too smart to read documentation, they would have run into big problems with LXD or sd-machined, too.
Post reply on HN