Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I just learned: Docker edits firewall rules for you

geoff.tuxpup.com

Post reply on HN
Print view View original

121–126 of 126 posts

Re: I just learned: Docker edits firewall rules for you

#121

Post by allarm »

Gordonjcp wrote: post #106
allarm wrote: post #102

Earlier quoted context omitted.

> the alternative is ridiculous. Like what is, having full control over your own system? I don’t think there’s anything wrong with not messing with my firewall and leaving this part to me. > is crazy And this is why, exactly?

How exactly do you *not* have full control of your system? Because typing in a command expressly designed to modify firewall rules... actually modifies firewall rules?

It’s not clearly stated in the docs, this is exactly how and why that happens.

Re: I just learned: Docker edits firewall rules for you

#122

Post by selfmodruntime »

chaps wrote: post #93
selfmodruntime wrote: post #89

Earlier quoted context omitted.

They mention that the port will be published to the internet. Usage of iptables is implementation detailed. They say to make sure to secure it. What else do you want? There is documentation on the behavior in the “docker for Linux” page

I want a damn mention of exactly what is changing on my system !! Why is that hard to understand and why are you trivializing such a big change? This isn't like a config file change that's OS implementation dependent. It's a freaking firewall change that has no obvious mention anywhere in its documentation ! That's huge!

Well, here you go I guess? https://docs.docker.com/network/iptables/

I found this right in the docker for linux documentation.

Can I ask, how else would you expect traffic to arrive at your container when you publish a port on the internet?

Re: I just learned: Docker edits firewall rules for you

#123

Post by Gordonjcp »

allarm wrote: post #121
Gordonjcp wrote: post #106

Earlier quoted context omitted.

How exactly do you *not* have full control of your system? Because typing in a command expressly designed to modify firewall rules... actually modifies firewall rules?

It’s not clearly stated in the docs, this is exactly how and why that happens.

It actually is, though, you just need to read them.

Re: I just learned: Docker edits firewall rules for you

#125

Post by teekert »

justinclift wrote: post #37
teekert wrote: post #29

Oh no I only expose ports on my tailnet. Or, I guess not then? How to check the status of the real firewall them, if ufw can mislead?

If you're legally allowed to run nmap against your host (eg some network places will have a real problem with it!) then it can be a useful way to check the "real world" reachability of ports.

After some testing, the port really only seems to be open on the tailnet, luckily.
Post reply on HN