3 ms·
> At the very least there should be firewall protection at host level If you read the Footgun at https://github.com/moby/moby/issues/4737 https://github.com/mo
by berkes 5y ago
> At the very least there should be firewall protection at host level
If you read the Footgun at https://github.com/moby/moby/issues/4737 https://github.com/moby/moby/issues/4737, this is exactly what happens: someone sets up a conservative firewall, then Docker drills holes in it and opens itself up to the world, regardless of your firewall.
- tigerBL00D 5y agoOkay, good point, and that's exactly why you isolate your networks. You don't want to be one configuration option from being wide open.
- berkes 5y agoTrue. In this case having a separate (hardware) firewall, a vpn setup or some other networking, protects you against this. That is poorly documented on Docker too. Yet, what Docker does is still wrong: it should not disable Ubuntu's default security. Ever. Even if that security is inadequate. An analogy would be to say "While watering your plants last night, I left all your windows open. Now your stuff is stolen. I did this because you should have installed window grills: without window grills your security sucks anyway."
- simiones 5y agoIsn't this to a much greater extent UFW's fault? If it claims to manage the firewall for your system, I would expect it to manage all of iptables, not just one particular chain that it thinks is important. At the very least, I would expect it to signal when there are other chains configured in iptables that it can't/won't manager for you.