Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I just learned: Docker edits firewall rules for you

geoff.tuxpup.com

Post reply on HN
Print view View original

61–70 of 126 posts

Re: I just learned: Docker edits firewall rules for you

#61

Post by nubinetwork »

Volundr wrote: post #18
nubinetwork wrote: post #13

Earlier quoted context omitted.

If ufw worked fine, they shouldn't have had to run "iptables -L" to find out that docker put in a rule that "ufw status" couldn't see. The commands should just be interchangeable.

UFW works by creating iptables rules. It intentionally does not expose the full functionality of iptables. The u is for "uncomplicated". The fact that you can add iptables chains that take precedence over the UFW managed chain is a feature of iptables, not a bug of UFW. You'll find the same is true of any Linux firewall that sits on top of iptables or nftables.

I use firehol. All it does is convert "interface eth0 server https allow" into the respective iptables rule(s). While in theory you could write additional iptables rules outside of firehol, there really isn't an equivalent to "ufw status", only "iptables -L"... no room for ambiguity.

Re: I just learned: Docker edits firewall rules for you

#63

Post by chaps »

selfmodruntime wrote: post #59
teraflop wrote: post #44

Earlier quoted context omitted.

Just about everyone who describes Docker, including the Docker documentation itself, describes "exposing" a port as creating a "mapping" between ports in the container and ports on the host. Furthermore, the "container networking" page ( https://docs.docker.com/config/containers/container-networki... ) says that Docker creates iptables rules for the purpose of creating this mapping. The clear implication is that, say…

No. This is not the case. There is a different term that does what you mean: "publishing" a port. It's different from the "EXPOSE XYZ" syntax, and is used in the docker cli with the "-p" command.

Maybe a lesson learned from this conversation is that the documentation isn't clear about what's going on and should be updated.

Re: I just learned: Docker edits firewall rules for you

#64

Post by chaps »

selfmodruntime wrote: post #56
chaps wrote: post #17

Earlier quoted context omitted.

Considering how aggressively docker has been pushed down peoples' throats over the past 10 years, from bootcamps to tutorial after tutorial teaching how to use docker... it seems pretty unreasonable to think that everybody is going to read the all of the docker docs that describe this problem. Considering the risks involved, it's frankly silly for them not to include a warning. Hell, in the "container networking" doc…

> By default, when you create or run a container using docker create or docker run, the container doesn’t expose any of it’s ports to the outside world. It doesn't? You're explicitly telling it to do so and then go on crying about how docker is awful.

that's word for word from: https://docs.docker.com/config/containers/container-networki...

Re: I just learned: Docker edits firewall rules for you

#65

Post by chaps »

selfmodruntime wrote: post #57
Godel_unicode wrote: post #28

Earlier quoted context omitted.

Who is marketing it that way? That’s insane.

It really is. I am astonished by the simple mindedness of some people in this thread. Half knowledge really is dangerous.

No need to call people simple minded, friend. It completely debases your point to the extent that it makes me question whether you understood their point. Consider the possibility that you simply misunderstood their point.

Re: I just learned: Docker edits firewall rules for you

#67

Post by Brian_K_White »

bionade24 wrote: post #55
skerit wrote: post #36

I learned this a few months ago too. It's such a weird, stupid system. But everyone seems to think this is pretty normal. I think the firewall is my business, and nothing else should automatically open ports in it. Especially not docker.

This is not about being unnormal, this is a design decision. Just because people use docker in the "tradional admin way", too doesn't mean it's a wrong decision to do this. Wishful thinking about what a command of a software does without looking it up is generally dangerous. There are abstractions to help people that don't want to bother, e.g. portainer.

Violates least surprise.

Re: I just learned: Docker edits firewall rules for you

#68

Post by Brian_K_White »

bionade24 wrote: post #3

While docker's port exposure should be more explicit, he should also mention that he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons. If he'd bind the host port to localhost or put caddy in a container in the same vlan, it wouldn't have happened. From the blogpost I'm not even sure if he's aware of the binding option. If you…

Failed to read the entire docs is orthagonal to harmful default behavior.

Maybe he also smells bad some days. So what? Docker is still wrong, and further, more wrong than the user.

Re: I just learned: Docker edits firewall rules for you

#69

Post by LinAGKar »

selfmodruntime wrote: post #53
ysleepy wrote: post #34

Earlier quoted context omitted.

Maybe inform yourself of the situation and consider again carefully. Should all programs running as root bypass a firewall explicitly configured by the user?

The real answer is that OP is using docker wrong. If you „publish“ a port, your firewall gets amended. This is clearly stated in the documentation. If you do not wish for that to happen, and instead want to use a reverse proxy, you „expose“ a port instead and reroute the requests into the docker bridge network.

No, it isn't. Looking at the documentation (https://docs.docker.com/compose/compose-file/compose-file-v3...), it doesn't mention the firewall anywhere.

Re: I just learned: Docker edits firewall rules for you

#70

Post by 2bluesc »

shudza wrote: post #8

You can also add `iptables: false` to docker's daemon json and docker will stop messing with your iptables conf.

This is on my todo list after wrestling docker almost in to compliance with nftables. Even so, I still have some issue with ports forwarded to docker services not NATting correctly and instead show up with a source IP of the docker bridge. Switching to nftables exclusively (docker is using iptables-nft) and preventing docker from doing this should resolve my issues.

I can't think of another application on any of my systems that muck with firewall rules behind the scenes like this.

Post reply on HN