3 ms·
I can also note that I didn't find any supported way to prevent that from happening. So it's one thing to find out that docker edit firewall rules. It's another
by vbezhenar 4y ago
I can also note that I didn't find any supported way to prevent that from happening. So it's one thing to find out that docker edit firewall rules. It's another thing to build a proper set of firewall rules which will prevent incoming connections.
I came up with some rules including DOCKER-USER chain but I'd qualify them as hack relying on undocumented configuration. And I just have no idea how to configure firewalld because it puts another layer of complexity on top of iptables.
- ethbr0 4y agoFYI, afaik firewalld as a high level interface is on the way out in RHEL* land (if that's what you're using), to be replaced by nftables.
- 2OEH8eoCRo0 4y agofirewalld is a high level interface to both nftables and iptables.
- ethbr0 4y agoAfaik, firewalld doesn't speak nftables (the tooling, not the backend). At least, in the sense that if you use nftables (the high level tooling/config) and firewalld (the high level tooling/config), there will be some incompatibilities. So it's either/or.