3 ms·

I think this still misses the point. It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. Opening random ports without A)

by Alupis 5y ago

I think this still misses the point. It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. Opening random ports without A) Telling the developer first, B) Requesting permission to do so, C) Explaining why Docker wants to do so and D) Providing the ability to "opt-out" of this insecure-by-default configuration - is very bad. It doesn't matter how secure or insecure the software inside the container is... it shouldn't be allowed to communicate with the public unless the developer specifically requests it.

mschuster91 5y ago
> It's Docker's responsibility to not open firewall ports unless explicitly asked to do so. You are asking Docker to open firewall ports with the -p option, it explicitly even says in the manual that published ports will be reachable from everywhere that can access the IP you're publishing on (either default 0.0.0.0 or an IP of your choosing).
- Alupis 5y ago
  The OP didn't pass this option to Docker, and it seems it's pretty well established to be a significant footgun[1]. I don't have a horse in this race, as I don't use Docker for a plethora of reasons dating back to it's inception. There are plenty of far superior containers to use. Just adding this footgun to the list of reasons... [1] https://github.com/moby/moby/issues/4737 https://github.com/moby/moby/issues/4737