111–120 of 126 posts
Earlier quoted context omitted.
This is exactly right. The alternative is ridiculous. Also, comparing expectations of Docker vs. something like nginx is crazy.
> the alternative is ridiculous. Like what is, having full control over your own system? I don’t think there’s anything wrong with not messing with my firewall and leaving this part to me. > is crazy And this is why, exactly?
You could choose not to install docker, for once.
Earlier quoted context omitted.
It clearly states “this will publish the mentioned port to the outside world”. How do you expect this to work? Magic?
No, it doesn't. That's not written anywhere on the page. And even if it were, the obvious interpretation of "outside world" would just be that it's available outside the container. And maybe that it's bound to the external network interfaces, but not that it bypasses the firewall.
What is a published port? Again, look in the documentation, it's clearly states there [1].
You need to learn to read the documentation of potentially dangerous tools fully. If you don't, you're in for a world of hurt. The outside world is clearly just that.
[0]: https://docs.docker.com/compose/compose-file/compose-file-v3... [1]: https://docs.docker.com/config/containers/container-networki...
Earlier quoted context omitted.
It clearly states “this will publish the mentioned port to the outside world”. How do you expect this to work? Magic?
Except it is not clear at all and should mention the firewall changes. I expect that publishing means listening on 0.0.0.0, not messing with the firewall.
What you expect does not matter. What you're thinking of is exposing. It's even in the word "publish".
The documentation has two sections entirely devoted to the terms. It's in the section "container networking", which is marked as required reading by the docs.
It's not dockers fault that you're copy pasting configuration examples from medium blogs.
[0]: https://docs.docker.com/config/containers/container-networki...
Earlier quoted context omitted.
No they shouldn't, just how nginx shouldn't manipulate iptables just because you've said it should listen to 443 on "the network". Many times you don't even want docker containers to go "to the network" directly and it shouldn't assume unsecure behaviour by default. Moreover, CRITICALLY, you can't prevent Docker from doing that and you can ONLY secure the machine by adding another rule on top that supresses Dockers r…
You can prevent docker from doing that by editing its config, but you have to read the documentation to know that. As you have to, to actually know what a certain command does, too.
Earlier quoted context omitted.
It really is. I am astonished by the simple mindedness of some people in this thread. Half knowledge really is dangerous.
No need to call people simple minded, friend. It completely debases your point to the extent that it makes me question whether you understood their point. Consider the possibility that you simply misunderstood their point.
Earlier quoted context omitted.
No. This is not the case. There is a different term that does what you mean: "publishing" a port. It's different from the "EXPOSE XYZ" syntax, and is used in the docker cli with the "-p" command.
Maybe a lesson learned from this conversation is that the documentation isn't clear about what's going on and should be updated.
While docker's port exposure should be more explicit, he should also mention that he used docker without reading the parts of the doc he neeeded to, blindly trusting some dangerous half-knowledge from a forum or other persons. If he'd bind the host port to localhost or put caddy in a container in the same vlan, it wouldn't have happened. From the blogpost I'm not even sure if he's aware of the binding option. If you…
Failed to read the entire docs is orthagonal to harmful default behavior. Maybe he also smells bad some days. So what? Docker is still wrong, and further, more wrong than the user.
Use podman and ditch docker, you can even alias it.
Earlier quoted context omitted.
Except it is not clear at all and should mention the firewall changes. I expect that publishing means listening on 0.0.0.0, not messing with the firewall.
See my comment above. Firewall changes are clearly mentioned under the section "published ports". What you expect does not matter. What you're thinking of is exposing. It's even in the word "publish". The documentation has two sections entirely devoted to the terms. It's in the section "container networking", which is marked as required reading by the docs. It's not dockers fault that you're copy pasting configuratio…
> This creates a firewall rule in the container
We’re done here.