4 ms·

Isn’t exposing ports in your docker-compose services:redis:ports, how you’d do that? (Docker hobbyist here)

jcrawfordor 6y ago
My guess would be that they went with "ports" instead of "expose" which makes it public. But even with careful composition of your docker-compose you might want to be careful, Docker can interact with iptables in surprising ways and long iptables rulesets are almost comically difficult to validate sometimes. The result is that if you're using both Docker (and even more if you use Compose, Kubernetes, some other orchestrator) and doing anything else with iptables (including using it as a host firewall) you need to take a lot of caution to make sure you don't mess anything up. These tools usually confine their changes to custom chains to make this stuff easier to sort out but at the same time it can make it more difficult to understand what's happening, particularly with the use of tagging and etc. In general I would recommend putting some kind of protection between machines running Docker (and especially orchestrators) and the internet. This could be cloud provider mechanisms (security groups, ACLs, etc), a firewall appliance, NAT gateway configuration, etc. depending on the situation. It's not necessary, but it makes the situation easier to audit/validate, and more layers of protection seldom hurt. If nothing else it means that much of the time you'll need to make a mistake in two places instead of one, in order to have an unintended exposure.
- gerdesj 6y ago
  "and long iptables rulesets are almost comically difficult to validate sometimes." Use nmap to evaluate your policy from the outside, don't try to validate it in your head by inspection.
  - acdha 6y ago
    Use Shodan.io’s monitor feature and you’ll get alerting, too.
- gavinray 6y ago
  Friendly FYI, "EXPOSE" is a no-op that is only meant as visual documentation to end-users. "The EXPOSE instruction does not actually publish the port. It functions as a type of documentation between the person who builds the image and the person who runs the container, about which ports are intended to be published." Second paragraph: https://docs.docker.com/engine/reference/builder/#expose https://docs.docker.com/engine/reference/builder/#expose
  - jcrawfordor 6y ago
    I'm referring to docker-compose, where 'port' and 'expose' are container configuration options that behave differently from the Dockerfile keyword. Although the similar words with different meanings no doubt contribute to confusion.
    - gavinray 6y ago
      Ah, my mistake. That comes off pretty asinine then, apologies.

My guess would be that they went with "ports" instead of "expose" which makes it public. But even with careful composition of your docker-compose you might want to be careful, Docker can interact with iptables in surprising ways and long iptables rulesets are almost comically difficult to validate sometimes. The result is that if you're using both Docker (and even more if you use Compose, Kubernetes, some other orchestrator) and doing anything else with iptables (including using it as a host firewall) you need to take a lot of caution to make sure you don't mess anything up. These tools usually confine their changes to custom chains to make this stuff easier to sort out but at the same time it can make it more difficult to understand what's happening, particularly with the use of tagging and etc. In general I would recommend putting some kind of protection between machines running Docker (and especially orchestrators) and the internet. This could be cloud provider mechanisms (security groups, ACLs, etc), a firewall appliance, NAT gateway configuration, etc. depending on the situation. It's not necessary, but it makes the situation easier to audit/validate, and more layers of protection seldom hurt. If nothing else it means that much of the time you'll need to make a mistake in two places instead of one, in order to have an unintended exposure.

gerdesj 6y ago
"and long iptables rulesets are almost comically difficult to validate sometimes." Use nmap to evaluate your policy from the outside, don't try to validate it in your head by inspection.
- acdha 6y ago
  Use Shodan.io’s monitor feature and you’ll get alerting, too.
gavinray 6y ago
Friendly FYI, "EXPOSE" is a no-op that is only meant as visual documentation to end-users. "The EXPOSE instruction does not actually publish the port. It functions as a type of documentation between the person who builds the image and the person who runs the container, about which ports are intended to be published." Second paragraph: https://docs.docker.com/engine/reference/builder/#expose https://docs.docker.com/engine/reference/builder/#expose
- jcrawfordor 6y ago
  I'm referring to docker-compose, where 'port' and 'expose' are container configuration options that behave differently from the Dockerfile keyword. Although the similar words with different meanings no doubt contribute to confusion.
  - gavinray 6y ago
    Ah, my mistake. That comes off pretty asinine then, apologies.