4 ms·
Seems like an edge case. 99% will be happy with the OS firewall.
by sgt 5y ago
Seems like an edge case. 99% will be happy with the OS firewall.
- k8sToGo 5y agoUntil they learn that Docker adds iptable rules on their own and open every port automatically.
- tfehring 5y agoEvery port on the machine, or every port on the container?
- remram 5y agoThe container's ports that you explicitly expose. E.g. `docker run -p 8080:80 nginx` will expose the container's port 80 as port 8080 on the host. That port will be open whether or not the host has a firewall configured to block 8080. You can do `docker run -p 127.0.0.1:8080:80 nginx` to only have the port on the host accessible on the loopback interface (for example if you have a reverse proxy on the host, proxying to 127.0.0.1:8080).
- tinco 5y agoI've been bitten by this, was a pain in the ass to figure out that something was messing with the iptables rules.
- HNTA0x0 5y agolaughs in Podman
- piaste 5y agoThere's also the option to spin up a tiny VM with pfSense/OPNsense and have it act as a bastion, is there not? Or would it introduce too much latency?
- k8sToGo 5y agoFrom my experience their cloud offerings are much slower network wise than the dedicated ones.
- Croftengea 5y agoNot quite. It's easier to define one set of rules for the entire server group (Projects in Hetzner terminology) and forget about it than to manage OS firewalls individually.