4 ms·

I'm a bit confused here about how this was a docker issue. Initially I thought there was some stuff happening with uPnP with a router/gateway of some sort (http

I'm a bit confused here about how this was a docker issue. Initially I thought there was some stuff happening with uPnP with a router/gateway of some sort (https://en.wikipedia.org/wiki/Universal_Plug_and_Play https://en.wikipedia.org/wiki/Universal_Plug_and_Play) If I run a docker container on my macbook and expose a port over 0.0.0.0 (docker run -d -p 8080:8080 nginx) and it's available on my LAN network, how does it get exposed over the internet? Unless there's a rule in my router/gateway which does the port forwarding, it's not possible. I wish the author goes into a bit more detail onto how his setup was vulnerable rather than bringing up an old Github Issue.

qbasic_forever 5y ago
It's not a problem on docker desktop for mac or windows. It's only an issue on linux, and only for systems that use iptables as a firewall (typically ubuntu/debian & ufw). And even more specifically it really only affects servers that are in a hosting environment with no other firewall or protection in front--Digital Ocean's default droplet config is a prime example, on AWS by default you have a cloud-specific firewall provided by Amazon's networking. On your system docker is running in a little virtual machine that has its own linux kernel, virtual peripherals, etc. This gives you an extra layer of security (by pure happenstance) such that the VM has to allow traffic in too. And this is kind of why this issue is so nasty. You as a mac user might never know that this is a problem or potential footgun. You could happily develop entire production services on your mac, then move them to a shared linux host like Digital Ocean and... uh oh, now your services are open and you had no idea it was even possible.
- tedk-42 5y ago
  But this isn't a linux issue - this is by design. If you're deploying code without knowing how networking works, you're always going to have problems with this like this. Perhaps my example was a little too simplified as AWS is my day-to-day cloud host but I find it hard to believe opening up ports on your VM and exposing it to the world and then placing the blame on docker is fair.
boardwaalk 5y ago
Any old hosted server is going to public to the internet by default. There's no indication that this is hosted locally or in some private network (like AWS VPC).
TheDong 5y ago
It's fairly normal for a laptop to be on a network behind a router/gateway. It's also fairly normal for a server to have public IPs associated with it directly, and for those IPs to be available to the public internet directly. The latter is what probably happened here. Newsblur appears to run on digital ocean, where I believe they still default to associating a public IPv4 address to each droplet, which again is pretty normal in the server world.
- tedk-42 5y ago
  'Really normal in the server world' is something i heavily disagree with. So there was no firewall then? https://www.digitalocean.com/blog/cloud-firewalls-secure-droplets-by-default/ https://www.digitalocean.com/blog/cloud-firewalls-secure-dro...
  - deleted 5y ago
    [deleted]
- bombcar 5y ago
  And more and more things are getting publicly routable ipv6 addresses even when behind an ipv4 NAT device. So if you’re not careful you may be exposed on ipv6 even if incidentally protected on ipv4 by the NAT.

qbasic_forever 5y ago

It's not a problem on docker desktop for mac or windows. It's only an issue on linux, and only for systems that use iptables as a firewall (typically ubuntu/debian & ufw). And even more specifically it really only affects servers that are in a hosting environment with no other firewall or protection in front--Digital Ocean's default droplet config is a prime example, on AWS by default you have a cloud-specific firewall provided by Amazon's networking. On your system docker is running in a little virtual machine that has its own linux kernel, virtual peripherals, etc. This gives you an extra layer of security (by pure happenstance) such that the VM has to allow traffic in too. And this is kind of why this issue is so nasty. You as a mac user might never know that this is a problem or potential footgun. You could happily develop entire production services on your mac, then move them to a shared linux host like Digital Ocean and... uh oh, now your services are open and you had no idea it was even possible.

tedk-42 5y ago
But this isn't a linux issue - this is by design. If you're deploying code without knowing how networking works, you're always going to have problems with this like this. Perhaps my example was a little too simplified as AWS is my day-to-day cloud host but I find it hard to believe opening up ports on your VM and exposing it to the world and then placing the blame on docker is fair.

boardwaalk 5y ago

Any old hosted server is going to public to the internet by default. There's no indication that this is hosted locally or in some private network (like AWS VPC).

TheDong 5y ago

It's fairly normal for a laptop to be on a network behind a router/gateway. It's also fairly normal for a server to have public IPs associated with it directly, and for those IPs to be available to the public internet directly. The latter is what probably happened here. Newsblur appears to run on digital ocean, where I believe they still default to associating a public IPv4 address to each droplet, which again is pretty normal in the server world.

tedk-42 5y ago
'Really normal in the server world' is something i heavily disagree with. So there was no firewall then? https://www.digitalocean.com/blog/cloud-firewalls-secure-droplets-by-default/ https://www.digitalocean.com/blog/cloud-firewalls-secure-dro...
- deleted 5y ago
  [deleted]
bombcar 5y ago
And more and more things are getting publicly routable ipv6 addresses even when behind an ipv4 NAT device. So if you’re not careful you may be exposed on ipv6 even if incidentally protected on ipv4 by the NAT.