3 ms·
I’m kind of shocked this is even deemed acceptable architecture. You’d think docker wouldn’t even touch iptables unless explicitly told to.
by bushbaba 5y ago
I’m kind of shocked this is even deemed acceptable architecture. You’d think docker wouldn’t even touch iptables unless explicitly told to.
- qbasic_forever 5y agoIt's how they can make containers feel like isolated little subnets without resorting to vxlan or other kernel-level stuff. It's a great development experience and I'd be sad to see it go. But.... it really needs to proactively detect and warn users. The issue has been known for many years. A quick little check and error out on startup if you're running on Ubuntu or have ufw enabled would probably save 99% of the pain people have had with it over the years.
- 1337shadow 5y agoIt works fine when users create docker networks for their containers to communicate, which docker-compose does by default, instead of publishing ports on 0.0.0.0 like yolo
- AtNightWeCode 5y agoI would say that this is the expected behavior. Also, I don't think one should rely on firewalls in this way.
- Shank 5y agoRelying on firewalls to do what firewalls do and have done and continue to do seems perfectly acceptable. Yes, your database should have authentication enabled too, but expecting ports to not be unexpectedly open is the entire point of firewalls.
- AtNightWeCode 5y agoKind of what I said. Firewalls are for blocking unwanted traffic. It should not be used as a replacement for other security measures. "unexpectedly open", well, there I simply disagree.
- Aeolun 5y agoSo if you have a firewall set to block everything, and you run a docker container that listens to your global IP, you expect it to magic your firewall for you?
- AtNightWeCode 5y agoYes. I would assume that any service platform or services for that matter may have open ports as default and that you should place it in a private network with a proxy in front of it.