3 ms·

What software that anyone actually uses does this, except for docker (which has well documented ways of using it properly that are tragically not the default)?

• justinclift 5y ago
  > well documented ways of using it properly that are tragically not the default Docker is the stand out case from my point of view, and the ways it breaks networking seems to randomly change from version to version without warning nor consistency. What are the well documented ways of using it properly, that avoid this weird behaviour from Docker?
  • krageon 5y ago
    Exposing ports breaks every security model in your firewall, which is why you should expose ports explicitly to localhost and if you want to expose them to the outside world you use a routing application (e.g. haproxy). I think that is the most obvious one. The fact that it messes with your iptables rules in a way that is frankly not very transparent is something that cannot be fixed, except by not using docker :)
    • justinclift 5y ago
      > Exposing ports breaks every security model in your firewall Of course. That's why we do only bind them to localhost, and tend to use nginx to proxy from that to the outside world (for web apps anyway). That being said, I've still seen Docker do dumb stuff with port mapping, and seen it change behaviour between "minor" version updates. Though that was a while (few years) ago now. > ... except by not using docker Kind of stuck with it for now, and having to work around it's crappiness. ;)