3 ms·
> please take it slow and make Docker great again! Perhaps they should create some sort of firewall? I mean, the network packets coming through... they bring m
by vacri 10y ago
> please take it slow and make Docker great again!
Perhaps they should create some sort of firewall? I mean, the network packets coming through... they bring malware... they're spam... and some, I assume, are good traffic.
- MichaelGG 10y agoThe good traffic should be already permitted in the firewall. If you're still having issues the firewall rules are probably not being enforced. I've seen this happen like when an any any allow rule is left in from debugging ("just to get things working").
- wastedhours 10y agoBut when your entire service is built on the notion of accepting all types of traffic, it's insulting to block it based on nothing more than opinion (I would point out for the avoidance of doubt, OP was making a Trump reference...)
- m_mueller 10y agoI agree very much. Trying to figure out how Docker hacks your host's iptables and how to deal with it in a production network is a pain.
- andrewguenther 10y agoWe never let Docker set its own iptables rules. It is a pain at first, but it forces you to understand how the rules work, what is going on, and has the added bonus of keeping those rules consistent across Docker releases and in your own version control.
- m_mueller 10y agoso as I understand you add and remove the port mapping and other FW entries with your own scripts whenever you spin up / stop a container?
- andrewguenther 10y agoPort mapping isn't handled by iptables, only the wiring of the docker virtual interface. We take care of that piece, but let docker do whatever it wants within that interface.
- nolite 10y agoGuys.. This was a trump joke
- wstrange 10y agoThose packets should be definitely be deported back to where they came from. And we should make them pay for the firewall.