Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I just learned: Docker edits firewall rules for you

geoff.tuxpup.com

Post reply on HN
Print view View original

81–90 of 126 posts

Re: I just learned: Docker edits firewall rules for you

#81

Post by bionade24 »

dijit wrote: post #76
bionade24 wrote: post #46

Earlier quoted context omitted.

Docker is certainly not marketed that way & even the majority of tutorials / if not all on Digital ocean or similar sites don't misguide you into doing this. It is clearly not marketed as "usable without reading docs" and even though people using it as a tool to deploy prebuilt software without learning its configuration, this doesn't apply to the docker commands itself. If https://www.portainer.io/ would do this imp…

Honestly, I am not sure if you're right with the marketing but the docker way of “doing everything needed in a tightly coupled way” does reek of a tool that is designed primarily for ease of use. Heck, this “issue” (which, I don’t agree is an issue) only exists so that people don't have to do an additional step. Its “ease of use” which violates the principle of least surprise most commonly.

The docker way is a way of using coontainers as a form of contained application building & distribution, which builds itself (optionally on top of layers from docker hub) from a Dockerfile and is configured by a docker-compose file, minimizing the need for external configuration tools that may have problems to keep up with new features. The other feature are the layered builds, which you can mix from multiple bases.

Docker does not compete with LXD which just runs containers like VMs, but with distrobuilder + LXD + including the init.yml in the deploy process.

Re: I just learned: Docker edits firewall rules for you

#82

Post by xboxnolifes »

Brian_K_White wrote: post #67
bionade24 wrote: post #55

Earlier quoted context omitted.

This is not about being unnormal, this is a design decision. Just because people use docker in the "tradional admin way", too doesn't mean it's a wrong decision to do this. Wishful thinking about what a command of a software does without looking it up is generally dangerous. There are abstractions to help people that don't want to bother, e.g. portainer.

Violates least surprise.

Accomplishes least resistance.

Re: I just learned: Docker edits firewall rules for you

#83

Post by teekert »

berkle4455 wrote: post #71
teekert wrote: post #29

Oh no I only expose ports on my tailnet. Or, I guess not then? How to check the status of the real firewall them, if ufw can mislead?

If you’re exposing ports on your tailnet then you’re presumably binding to those specific interfaces, right?

Nope I use ufw to only allow incoming on the tailnet [0]. Guess that I’ll ben nmapping some hosts soon…

[0]: https://blog.hmrt.nl/posts/first_steps_arch_box/#set-up-tail...

Re: I just learned: Docker edits firewall rules for you

#84

Post by NoZebra120vClip »

JohnFen wrote: post #77
NoZebra120vClip wrote: post #75

Earlier quoted context omitted.

A... program? You know that Docker containers are self-contained operating systems? The whole point of containers like Docker is to separate the allocation and control of resources via a middle way that is not quite virtualization. So a monolithic OS running on one computer is at one end of the spectrum, and a "separate hardware device" accessible by LAN is further along the spectrum, but it's a continuum. So I feel…

> You know that Docker containers are self-contained operating systems? That doesn't qualify as a program?

Well, if it's 1983, and the Master Control Program is after you, be careful not to get de-rezzed.

"Hey, I got a new program to install on my computer!" "What's your new program called?" "This program is... Ubuntu Linux."

Re: I just learned: Docker edits firewall rules for you

#85

Post by Godel_unicode »

chaps wrote: post #64
selfmodruntime wrote: post #56

Earlier quoted context omitted.

> By default, when you create or run a container using docker create or docker run, the container doesn’t expose any of it’s ports to the outside world. It doesn't? You're explicitly telling it to do so and then go on crying about how docker is awful.

that's word for word from: https://docs.docker.com/config/containers/container-networki...

By default, as the docs very clearly state, ‘docker run’ doesn’t make network changes.

The blog post was written by someone who has a compose file which changes this default behavior, which is extremely unsurprising as that is the entire purpose of compose files. If you change the default behavior, then the default behavior no longer applies and you should read the docs pertaining to how you changed the behavior.

Re: I just learned: Docker edits firewall rules for you

#86

Post by chaps »

Godel_unicode wrote: post #85
chaps wrote: post #64

Earlier quoted context omitted.

that's word for word from: https://docs.docker.com/config/containers/container-networki...

By default, as the docs very clearly state, ‘docker run’ doesn’t make network changes. The blog post was written by someone who has a compose file which changes this default behavior, which is extremely unsurprising as that is the entire purpose of compose files. If you change the default behavior, then the default behavior no longer applies and you should read the docs pertaining to how you changed the behavior.

You're being really generous to the documentation at Docker. It stinks and doesn't make it clear that it punches a hole in your firewall.

Neither the compose quickstart [1], nor the compose specification [2] mention anything about iptables nor firewalls. The compose specification adds more details than the quickstart, but... it's obtuse, and overall a 12,000 word document! Surely that incredibly important information that has demonstrably and unexpectedly led to external access should be contained in either of these documents! Surely you can agree that their documentation should contain either the word "iptables" or "firewall"?!

[1] https://docs.docker.com/compose/gettingstarted/ [2] https://docs.docker.com/compose/compose-file/

Re: I just learned: Docker edits firewall rules for you

#87

Post by longitudinal93 »

This is a trend that needs to be sharply curtailed. The last time I _re-started_ my Big Blue Button server it automatically installed UFW along with it's own ruleset completely locking me out as I run SSHD on a non-standard port. All without asking or even telling me it was going to do this. Aargh!

Re: I just learned: Docker edits firewall rules for you

#88

Post by selfmodruntime »

LinAGKar wrote: post #69
selfmodruntime wrote: post #53

Earlier quoted context omitted.

The real answer is that OP is using docker wrong. If you „publish“ a port, your firewall gets amended. This is clearly stated in the documentation. If you do not wish for that to happen, and instead want to use a reverse proxy, you „expose“ a port instead and reroute the requests into the docker bridge network.

No, it isn't. Looking at the documentation ( https://docs.docker.com/compose/compose-file/compose-file-v3... ), it doesn't mention the firewall anywhere.

It clearly states “this will publish the mentioned port to the outside world”. How do you expect this to work? Magic?

Re: I just learned: Docker edits firewall rules for you

#89

Post by selfmodruntime »

chaps wrote: post #86
Godel_unicode wrote: post #85

Earlier quoted context omitted.

By default, as the docs very clearly state, ‘docker run’ doesn’t make network changes. The blog post was written by someone who has a compose file which changes this default behavior, which is extremely unsurprising as that is the entire purpose of compose files. If you change the default behavior, then the default behavior no longer applies and you should read the docs pertaining to how you changed the behavior.

You're being really generous to the documentation at Docker. It stinks and doesn't make it clear that it punches a hole in your firewall. Neither the compose quickstart [1], nor the compose specification [2] mention anything about iptables nor firewalls. The compose specification adds more details than the quickstart, but... it's obtuse, and overall a 12,000 word document! Surely that incredibly important information…

They mention that the port will be published to the internet. Usage of iptables is implementation detailed. They say to make sure to secure it. What else do you want? There is documentation on the behavior in the “docker for Linux” page

Re: I just learned: Docker edits firewall rules for you

#90

Post by Gordonjcp »

justinclift wrote: post #33
Gordonjcp wrote: post #27

Earlier quoted context omitted.

What's asinine is "I configured it wrong and it broke, it's a bug in docker".

Docker's networking behaviour famously changes between point releases, sometimes without even being mentioned in the release notes. Very much a case of "make sure you use some sort of overarching firewall solution" wrapping your Docker hosts, otherwise you can be in for a world of hurt. :/ Their support for IPv6 used to be extremely shitty too, with the documented switch to enable it... not working at all. Heh. ;) Th…

No, you don't need a firewall.

Docker doesn't expose anything to the public interface unless you specifically request that it does.

If you don't understand the implications of this, you should not be running servers.

It is absolute shite at doing IPv6, which is annoying.

Post reply on HN