3 ms·
Just want to confirm I understand the issue here. 1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666 2.
by dirkc 5y ago
Just want to confirm I understand the issue here.
1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666
2. `docker run -p 127.0.0.1:6666:6666 ...` - docker won't update the firewall.
3. `docker run -p 6666` - the port is published on 0.0.0.0 and a random port is opened on the host
I see 3 being a little surprising, but 1 and 2 does what I would expect of it.
- aorth 5y ago> 1. `docker run -p 0.0.0.0:6666:6666 ...` - docker will update the firewall to allow traffic to port 6666 I don't think Docker should touch the firewall whatsoever. Apache doesn't, nginx doesn't, PostgreSQL doesn't, etc. Why is Docker different? The sysadmin should decide that!
- maple3142 5y agoMaybe it is more convenient to developer so that they don't have to touch the firewall? Docker is not only used by sysadmin.
- Liquid_Fire 5y agoWhy not add a --open-firewall-ports option and let the user decide? Maybe print a warning without that option if the port is not open if you really want to make it easy.
- aorth 5y agoHaha yes of course it's easier for developers, but they write the software that I have to deploy and manage on my server!
- rmetzler 5y agoI think the one case you missed is `docker run -p 6666:6666 ...` which defaults to `-p 0.0.0.0:6666:6666` I can't find it in the article, but I suspect this what actually happened. It's a bad default and unfortunately most examples build on it. Similar, it's easy to deploy MongoDB without a password. But it's also easy to set one, the docs even mention it https://hub.docker.com/_/mongo https://hub.docker.com/_/mongo And everyone can run a portscan with nmap against their servers. Unfortunately the MongoDB default ports 27017-27019 are not part of the top 1000 ports which nmap scans by default.