4 ms·
If you have Docker then make sure you have a firewall on top of it, otherwise it will expose pretty much what any docker user wants !
by 1337shadow 6y ago
If you have Docker then make sure you have a firewall on top of it, otherwise it will expose pretty much what any docker user wants !
- BrandoElFollito 6y agoWhat do you mean by that?
- Sebb767 6y agoDocker uses it's own iptables rules which have priority over the system ones. Therefore, even if you have an iptables-based firewall blocking all ports, a docker service will still be reachable, unless configured not to be in docker itself.
- BrandoElFollito 6y agoI do not understand what you mean by "priority over the system ones" A docker container can have internal ports exposed explicitly, or use host networking. In any case these are ports exposed by the docker-proxy executable - an executable like any other on the system. Then come the iptables rules of the system (which open or not data flow to the ports exposed by docker-proxy). Or is it different?
- BrandoElFollito 6y agoAh, now I get what you mean - that entries such as ACCEPT tcp -- anywhere 172.19.0.10 tcp dpt:8843 are created by docker, independently from the configuration of iptables themselves.
- Sebb767 6y agoTaking precedence was not the ideal word - it uses the same ip tables, but it inserts its own table as the first one. Therefore it 'ignores' system rules, which might come at a surprise.