Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

blog.newsblur.com

Post reply on HN
Print view View original

101–110 of 117 posts

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#101

Post by cpuguy83 »

ilyt wrote: post #97
cpuguy83 wrote: post #91

Earlier quoted context omitted.

Docker is not implicitly doing anything. The user requested for the port to get published and so docker published it. As nice as it would be for Docker to be more configurable in terms of where rules get inserted, that would not have helped here because the user already misconfigured things (should be using docker networks for db access). Technically docker even has a chain that you can throw rules into that will get…

Docker is implicitly overriding existing rules by putting their own ones in front. The least it should do is to put a warning "hey, there are other rules here,I'm adding my own, please verify. It should also have option (I only found "complete on/complete off" one) to "just" create its DOCKER* chains and leave the jumping to them to the user

> I only found "complete on/complete off" one

Docker has a `DOCKER-USER` chain where the user can inject their own rules before docker's rules are run.

But even then, the user flat out should not be using `-p` unless they want to expose the service outside of the machine. That is the well documented networking model of docker. Docker also includes a network abstraction that should have been used here to give access to other services that need it and isolate it from the things that don't.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#102

Post by remram »

nickjj wrote: post #60

Am I missing something? The article wrote: > When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world But the blog post doesn't mention how Docker "helpfully inserted an allow rule". Is this because NewsBlur ran the container using the -p 27017:27017 flag without reading the docs around what publishing a port does? You don't need to publish a port for (2) co…

Yeah I don't want to pretend that it's not a footgun, because it is a footgun and it should have defaulted to binding to 127.0.0.1... but it does not "insert an allow rule" or "override the firewall" or anything like that. It just uses forwarding rather than listening on a port, because container and virtual machines are not regular processes, and the iptables "nat" table is used before the "filter" table that his firewall uses.

So I agree with you, the author is being very dishonest here.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#103

Post by remram »

cpuguy83 wrote: post #85
mannykannot wrote: post #56

"When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world." Yet another reminder that the most important ability in systems engineering is good judgement.

To be clear, Docker inserted an allow rule because the user asked it to. Docker is relatively easy to set up without needing to use port forwarding to allow communication. Docker's networking model is explicitly designed to prevent the scenario in the post. Not to negate the fact that many are surprised by how docker bypasses ufw rules. This is painful and I would love to see a way for people to safely use port forwa…

Docker does not "insert an allow rule", it uses the "nat" table to forward connections to the container, and not the "filter" table where the firewall rules live. So packets never go through those filters.

This is not a consequence of Docker's action but a fact of how Linux networking works. Docker could have bigger warnings, or default to only accepting connections from localhost (I think it should), but it could not easily change the way Linux networking works to extend the host's firewall to the containers.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#104

Post by remram »

yjftsjthsd-h wrote: post #54
wkdneidbwf wrote: post #41

Earlier quoted context omitted.

what. docker isn’t the problem here. dbs on public subnets, and the lack of monitoring for accidental db exposure are the actual issues here.

> docker isn’t the problem here I mean... if they weren't using docker it would have been fine, but because they used docker it wasn't fine. That reads like docker is the problem. That further layers could have mitigated it doesn't make docker not the problem.

By that logic you could say that iptables/netfilter was the problem. Or Linux. Or maybe the IP protocol.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#105

Post by nickstinemates »

rollcat wrote: post #88
nickstinemates wrote: post #29

Earlier quoted context omitted.

Use `docker network` or the equivalent in the docker-compose file. Not taking time to think about how the software works is not the fault of the software.

> Use `docker network` or the equivalent in the docker-compose file. Everyone knows what the correct solution is. That's not what the discussion is about. > Not taking time to think about how the software works You're blaming the effect of poor design on alleged incompetence of people you know nothing about.

> Everyone knows what the correct solution is.

Clearly not.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#106

Post by nickstinemates »

nickjj wrote: post #60

Am I missing something? The article wrote: > When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world But the blog post doesn't mention how Docker "helpfully inserted an allow rule". Is this because NewsBlur ran the container using the -p 27017:27017 flag without reading the docs around what publishing a port does? You don't need to publish a port for (2) co…

> Is this because NewsBlur ran the container using the -p 27017:27017 flag without reading the docs around what publishing a port does?

Yep, and ended up shifting blame to Docker by calling it a "footgun."

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#107

Post by ilyt »

cpuguy83 wrote: post #101
ilyt wrote: post #97

Earlier quoted context omitted.

Docker is implicitly overriding existing rules by putting their own ones in front. The least it should do is to put a warning "hey, there are other rules here,I'm adding my own, please verify. It should also have option (I only found "complete on/complete off" one) to "just" create its DOCKER* chains and leave the jumping to them to the user

> I only found "complete on/complete off" one Docker has a `DOCKER-USER` chain where the user can inject their own rules before docker's rules are run. But even then, the user flat out should not be using `-p` unless they want to expose the service outside of the machine. That is the well documented networking model of docker. Docker also includes a network abstraction that should have been used here to give access t…

Which is a terrible solution no firewall manager would support

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#108

Post by yjftsjthsd-h »

remram wrote: post #104
yjftsjthsd-h wrote: post #54

Earlier quoted context omitted.

> docker isn’t the problem here I mean... if they weren't using docker it would have been fine, but because they used docker it wasn't fine. That reads like docker is the problem. That further layers could have mitigated it doesn't make docker not the problem.

By that logic you could say that iptables/netfilter was the problem. Or Linux. Or maybe the IP protocol.

I don't think so; at worst, each of those is passive and might fail to make you more secure. Docker goes out of its way to add holes to existing security. It's like... if iptables decided to ship a feature that detected when it was running in AWS and "helpfully" automatically reconfigured your security groups to allow any traffic that was allowed in iptables, that would be the same.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#109

Post by remram »

yjftsjthsd-h wrote: post #108
remram wrote: post #104

Earlier quoted context omitted.

By that logic you could say that iptables/netfilter was the problem. Or Linux. Or maybe the IP protocol.

I don't think so; at worst , each of those is passive and might fail to make you more secure. Docker goes out of its way to add holes to existing security. It's like... if iptables decided to ship a feature that detected when it was running in AWS and "helpfully" automatically reconfigured your security groups to allow any traffic that was allowed in iptables, that would be the same.

I posted that a bunch of times already but that's not what happens. Docker does not override the firewall, it just uses forwarding which kick in before filtering (iptables has separate "nat" and "filter" tables). The host's firewall just doesn't apply to containers and VMs, because they are not listening on a port on the host.

Docker could not extend the host's firewall to containers without changing how iptables work.

Re: A Docker footgun led to a vandal deleting NewsBlur's MongoDB database (2021)

#110

Post by piperswe »

bornfreddy wrote: post #78
chrismeller wrote: post #75

Earlier quoted context omitted.

I didn’t say he shouldn’t use containerization. He just shouldn’t have used Docker. Docker has always been very dev environment focused.

Are you aware of another containerization technology that would be more suitable? (genuinly curious - I only have experience with Docker and never felt the need to look elsewhere, even with footguns, but I'm still curious)

containerd is a reasonably common container runtime used with Kubernetes
Post reply on HN