4 ms·
I would love it if PAASs such as Heroku and Fly.io had configurable outbound firewalls. Especially when building with un-curated package managers such as NPM an
by samwillis 5y ago
I would love it if PAASs such as Heroku and Fly.io had configurable outbound firewalls. Especially when building with un-curated package managers such as NPM and PyPi, it’s virtually impossible to audit all dependencies.
Exploits like this and the now regular news of packages being replaced with backdoored versions makes me very nervous. Being able to whitelist what outbound connections were aloud would help enormously, even though it would not solve all potential exploits.
Is there a recommended way to do this with a Docker app?
Edit: Should note already use inbound waf like CloudFlare. What I want is something like Little Snitch but for a PAAS deployed app.
- ferdowsi 5y agoThis is the niche that made WAFs like Signal Sciences so successful.
- samwillis 5y agoI’m not sure Signal Sciences covers what I’m looking for. I see it has a agent you run alongside your app but does it block outbound connections? I have been looking through their docs and can’t see anything.
- mrweasel 5y agoFor PAAS this won’t work, but for on-prem stuff you can just log firewall denies on outbound traffic that will quickly let you know if somethings wrong. You could have test environment where your container run for a few days, before pushing into production on a PAAS. Just run the container on a VM with IPTables and logging. It won’t find everything, some call might only be called on very specific circumstance, but it could find low hanging fruits.