Using "ufw" on a production server is an anti-pattern, in my opinion. You should use something like ferm instead.
can you please explain why?
A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
81–90 of 117 posts
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#82Earlier quoted context omitted.
Where does the buck stop? This was simply a few layers of bad configuration. They didn't secure their database with auth/access control and they misconfigured docker. They have a few things at their disposal: - Using the docker-user chain to set firewall rules - Running docker such that the default bind address for the port directive is 127.0.0.1 instead of 0.0.0.0. This puts a safety on the footgun. - Explicitly set…
> They didn't secure their database with auth/access control True, although they had reason to believe that that was safe. > they misconfigured docker. Ah, no, that's where we disagree. They didn't configure it, docker shipped an insane default that bypasses existing security measures. There is absolutely no reason to expect that running a program in docker magically makes it ignore the system firewall.
The sysadmin is responsible for what they install and how it's configured. Docker didn't specify what ports to open, what container to run, volume mounts, image etc. That's part of the config the sysadmin supplies when they spin it up. No matter how you slice it, it down to them not understanding what they were pushing to prod.
By the same token having an unsecured database is a bad default, so we can keep passing the buck around.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#83Earlier quoted context omitted.
I didn’t say he shouldn’t use containerization. He just shouldn’t have used Docker. Docker has always been very dev environment focused.
Are you aware of another containerization technology that would be more suitable? (genuinly curious - I only have experience with Docker and never felt the need to look elsewhere, even with footguns, but I'm still curious)
Some will suggest that Podman is a good choice: https://podman.io/
Though personally I would miss Docker Swarm which comes with Docker by default and, in my opinion, is a nice bridge between something like Docker Compose (easy single node deployments) and Nomad/Kubernetes (both more complex in comparison, need separate setup and lots of admin work).
Personally I also think that Docker is sufficient in most cases and is pretty boring and stable. Docker Desktop might irk some, but seems like they wanted that revenue.
However, for desktop GUI, Podman has Podman Desktop: https://podman-desktop.io/
Or one can also consider Rancher Desktop as another GUI tool, if desired: https://rancherdesktop.io/
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#84Just wanted to say that I recently started reading RSS again and NewsBlur has been excellent. It’s a good aggregator, has a great web interface, and a great iOS app. The free tier is all you need (so I guess I’ll need to pay just out of my desire to support).
I pay just for the newsletter aggregation support. I actually read it through NetNewsWire on iOS and macOS. Very happy with the setup.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#85"When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world." Yet another reminder that the most important ability in systems engineering is good judgement.
To be clear, Docker inserted an allow rule because the user asked it to. Docker is relatively easy to set up without needing to use port forwarding to allow communication. Docker's networking model is explicitly designed to prevent the scenario in the post.
Not to negate the fact that many are surprised by how docker bypasses ufw rules. This is painful and I would love to see a way for people to safely use port forwarding without surprises like this.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#86Earlier quoted context omitted.
If they had understood how docker works, it would've been fine, too. But because they didn't and used a software firewall as their only line of defense and didn't bother with authentication for the DB server, it wasn't fine.
> If they had understood how docker works, it would've been fine, too. They shouldn't have needed to, for this. > But because they didn't and used a software firewall as their only line of defense Okay? That should have been safe. Like, sure, there are ways to add more layers, but that layer shouldn't have failed them. > didn't bother with authentication for the DB server, it wasn't fine. They shouldn't have needed t…
Running a server is a lot like doing electrical work. If you don't really know what you're doing and rely on vague intuition about how things should probably work, you might be in for a shock.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#87Earlier quoted context omitted.
nginx listens on port 80. Accessible from machine. Inaccessible from outside unless allowed by ufw. docker listens on port X. Accessible on machine. Also accessible from outside regardless of ufw. No amount of time and experience will make you think that configuring a software to listen on a port will automagically poke a hole in the firewall.
The scope of Docker and nginx are incomparable, so the comparison is wrong. It starts with the simple truth: `docker` doesn't `listen` on any port. Or maybe a simple question: How can I run `docker run -p 8080 nginx` over and over without port conflict? Or - lets expand scope even more. How is docker supposed to know about your choice of firewall? What about upstream firewalls? What about multiple versions of firewal…
Just tried this because I usually use docker with k8s or compose, so wasn't sure of the behavior.
> It starts with the simple truth: `docker` doesn't `listen` on any port.
If I run the command below, `docker-proxy` starts listening on an incrementing port.
> Or maybe a simple question: How can I run `docker run -p 8080 nginx` over and over without port conflict?
Because you're not specifying a port on the host; you're specifying a port on the container. I've never used the single port form of `-p`; I would've guessed it was the same as `-p 8080:8080`.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#88Earlier quoted context omitted.
Yes it's user error, but it's also a nasty trap for users who are not careful. And it hurts the most, where people are most likely to make the mistake (developers need to publish ports to access local containers on their development machines, but must take care not to do so when deploying to production).
Use `docker network` or the equivalent in the docker-compose file. Not taking time to think about how the software works is not the fault of the software.
> Use `docker network` or the equivalent in the docker-compose file.
Everyone knows what the correct solution is. That's not what the discussion is about.
> Not taking time to think about how the software works
You're blaming the effect of poor design on alleged incompetence of people you know nothing about.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#89Earlier quoted context omitted.
Where does the buck stop? This was simply a few layers of bad configuration. They didn't secure their database with auth/access control and they misconfigured docker. They have a few things at their disposal: - Using the docker-user chain to set firewall rules - Running docker such that the default bind address for the port directive is 127.0.0.1 instead of 0.0.0.0. This puts a safety on the footgun. - Explicitly set…
> They didn't secure their database with auth/access control True, although they had reason to believe that that was safe. > they misconfigured docker. Ah, no, that's where we disagree. They didn't configure it, docker shipped an insane default that bypasses existing security measures. There is absolutely no reason to expect that running a program in docker magically makes it ignore the system firewall.
> True, although they had reason to believe that that was safe.
That's like the antithesis of layered security. There would be no point in layers if you assume a single layer will protect you.
Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)
#90Earlier quoted context omitted.
what. docker isn’t the problem here. dbs on public subnets, and the lack of monitoring for accidental db exposure are the actual issues here.
> docker isn’t the problem here I mean... if they weren't using docker it would have been fine, but because they used docker it wasn't fine. That reads like docker is the problem. That further layers could have mitigated it doesn't make docker not the problem.
it wouldn’t have been fine—they didn’t realize the configuration mistake until their database had been dropped. there are plenty of scenarios that could have led to the exact same outcome. i’d argue it would have been a matter of time.
the problem is that it was possible to accidentally expose their credential-less db to the internet _at all_ and that they had no monitoring or tools in place to detect the misconfiguration. that’s a design flaw, and again, not a docker-specific problem.