4 ms·

You can totally start a new mongodb container and connect other containers to it without ever using auth. I'm doing it right now with docker-compose for local d

You can totally start a new mongodb container and connect other containers to it without ever using auth. I'm doing it right now with docker-compose for local development.

mschuster91 5y ago
I and the post I replied to was talking about MySQL. MongoDB is an insecure pile of cow poo that has been so often implicated in hacks and data thefts that I don't get why a) anyone is STILL using it and b) the containers STILL don't have a security-first default.
- Alupis 5y ago
  I think this still misses the point. It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. Opening random ports without A) Telling the developer first, B) Requesting permission to do so, C) Explaining why Docker wants to do so and D) Providing the ability to "opt-out" of this insecure-by-default configuration - is very bad. It doesn't matter how secure or insecure the software inside the container is... it shouldn't be allowed to communicate with the public unless the developer specifically requests it.
  - mschuster91 5y ago
    > It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. You are asking Docker to open firewall ports with the -p option, it explicitly even says in the manual that published ports will be reachable from everywhere that can access the IP you're publishing on (either default 0.0.0.0 or an IP of your choosing).
    - Alupis 5y ago
      The OP didn't pass this option to Docker, and it seems it's pretty well established to be a significant footgun[1]. I don't have a horse in this race, as I don't use Docker for a plethora of reasons dating back to it's inception. There are plenty of far superior containers to use. Just adding this footgun to the list of reasons... [1] https://github.com/moby/moby/issues/4737 https://github.com/moby/moby/issues/4737

4 ms·

You can totally start a new mongodb container and connect other containers to it without ever using auth. I'm doing it right now with docker-compose for local d

by 0xbadcafebee 5y ago

You can totally start a new mongodb container and connect other containers to it without ever using auth. I'm doing it right now with docker-compose for local development.

mschuster91 5y ago
I and the post I replied to was talking about MySQL. MongoDB is an insecure pile of cow poo that has been so often implicated in hacks and data thefts that I don't get why a) anyone is STILL using it and b) the containers STILL don't have a security-first default.
- Alupis 5y ago
  I think this still misses the point. It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. Opening random ports without A) Telling the developer first, B) Requesting permission to do so, C) Explaining why Docker wants to do so and D) Providing the ability to "opt-out" of this insecure-by-default configuration - is very bad. It doesn't matter how secure or insecure the software inside the container is... it shouldn't be allowed to communicate with the public unless the developer specifically requests it.
  - mschuster91 5y ago
    > It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. You are asking Docker to open firewall ports with the -p option, it explicitly even says in the manual that published ports will be reachable from everywhere that can access the IP you're publishing on (either default 0.0.0.0 or an IP of your choosing).
    - Alupis 5y ago
      The OP didn't pass this option to Docker, and it seems it's pretty well established to be a significant footgun[1]. I don't have a horse in this race, as I don't use Docker for a plethora of reasons dating back to it's inception. There are plenty of far superior containers to use. Just adding this footgun to the list of reasons... [1] https://github.com/moby/moby/issues/4737 https://github.com/moby/moby/issues/4737