4 ms·

It is a long standing issue and is a gotcha for everyone. https://github.com/moby/moby/issues/22054 https://github.com/moby/moby/issues/22054 It's completely

It is a long standing issue and is a gotcha for everyone. https://github.com/moby/moby/issues/22054 https://github.com/moby/moby/issues/22054 It's completely asinine.

Gordonjcp 4y ago
What's asinine is "I configured it wrong and it broke, it's a bug in docker".
- justinclift 4y ago
  Docker's networking behaviour famously changes between point releases, sometimes without even being mentioned in the release notes. Very much a case of "make sure you use some sort of overarching firewall solution" wrapping your Docker hosts, otherwise you can be in for a world of hurt. :/ Their support for IPv6 used to be extremely shitty too, with the documented switch to enable it... not working at all. Heh. ;) The IPv6 thing may or may not be better now, but I haven't tried Docker with IPv6 in years so no idea.
  - Gordonjcp 4y ago
    No, you don't need a firewall. Docker doesn't expose anything to the public interface unless you specifically request that it does. If you don't understand the implications of this, you should not be running servers. It is absolute shite at doing IPv6, which is annoying.
    - justinclift 4y ago
      > Docker doesn't expose anything to the public interface unless you specifically request that it does. Heh Heh Heh. Having directly been involved in the clean up of it doing exactly that a few years ago, I'll just say that your confidence is dangerously misplaced. :(
      - Gordonjcp 4y ago
        Okay, give me the steps to reproduce it. What did you do, what did you get wrong, and why did it need "cleaned up"?
- ysleepy 4y ago
  Maybe inform yourself of the situation and consider again carefully. Should all programs running as root bypass a firewall explicitly configured by the user?
  - josephcsible 4y ago
    Not by default, but if you explicitly pass them a command-line flag that means "open this port to the network" then they should.
    - izacus 4y ago
      No they shouldn't, just how nginx shouldn't manipulate iptables just because you've said it should listen to 443 on "the network". Many times you don't even want docker containers to go "to the network" directly and it shouldn't assume unsecure behaviour by default. Moreover, CRITICALLY, you can't prevent Docker from doing that and you can ONLY secure the machine by adding another rule on top that supresses Dockers rule... and those dockers rule change over time making it easy for the blocking hack to stop working after an update and again make the machine unsecure.
      - selfmodruntime 4y ago
        You‘re wrong. If you use a command line argument that explicitely states „this will publish this port in your firewall for convenience“, a command line argument which you shouldn‘t use anyway, then you‘re on your own. You choose to do this. Docker assumes that you know what you‘re doing. You‘re also wrong in your last paragraph. There is the - easy - option to expose the port on your loopback, and re route to the docker bridge network by using a reverse proxy.
        nickstinemates 4y ago
        This is exactly right. The alternative is ridiculous. Also, comparing expectations of Docker vs. something like nginx is crazy.
- polotics 4y ago
  The law of least-surprise disagrees with you I am afraid: firewall rule override is clearly stepping off the limits of what containerization should provoke.

It is a long standing issue and is a gotcha for everyone. https://github.com/moby/moby/issues/22054 https://github.com/moby/moby/issues/22054 It's completely asinine.

Gordonjcp 4y ago

What's asinine is "I configured it wrong and it broke, it's a bug in docker".

justinclift 4y ago
Docker's networking behaviour famously changes between point releases, sometimes without even being mentioned in the release notes. Very much a case of "make sure you use some sort of overarching firewall solution" wrapping your Docker hosts, otherwise you can be in for a world of hurt. :/ Their support for IPv6 used to be extremely shitty too, with the documented switch to enable it... not working at all. Heh. ;) The IPv6 thing may or may not be better now, but I haven't tried Docker with IPv6 in years so no idea.
- Gordonjcp 4y ago
  No, you don't need a firewall. Docker doesn't expose anything to the public interface unless you specifically request that it does. If you don't understand the implications of this, you should not be running servers. It is absolute shite at doing IPv6, which is annoying.
  - justinclift 4y ago
    > Docker doesn't expose anything to the public interface unless you specifically request that it does. Heh Heh Heh. Having directly been involved in the clean up of it doing exactly that a few years ago, I'll just say that your confidence is dangerously misplaced. :(
    - Gordonjcp 4y ago
      Okay, give me the steps to reproduce it. What did you do, what did you get wrong, and why did it need "cleaned up"?
ysleepy 4y ago
Maybe inform yourself of the situation and consider again carefully. Should all programs running as root bypass a firewall explicitly configured by the user?
- josephcsible 4y ago
  Not by default, but if you explicitly pass them a command-line flag that means "open this port to the network" then they should.
  - izacus 4y ago
    No they shouldn't, just how nginx shouldn't manipulate iptables just because you've said it should listen to 443 on "the network". Many times you don't even want docker containers to go "to the network" directly and it shouldn't assume unsecure behaviour by default. Moreover, CRITICALLY, you can't prevent Docker from doing that and you can ONLY secure the machine by adding another rule on top that supresses Dockers rule... and those dockers rule change over time making it easy for the blocking hack to stop working after an update and again make the machine unsecure.
    - selfmodruntime 4y ago
      You‘re wrong. If you use a command line argument that explicitely states „this will publish this port in your firewall for convenience“, a command line argument which you shouldn‘t use anyway, then you‘re on your own. You choose to do this. Docker assumes that you know what you‘re doing. You‘re also wrong in your last paragraph. There is the - easy - option to expose the port on your loopback, and re route to the docker bridge network by using a reverse proxy.
      - nickstinemates 4y ago
        This is exactly right. The alternative is ridiculous. Also, comparing expectations of Docker vs. something like nginx is crazy.
polotics 4y ago
The law of least-surprise disagrees with you I am afraid: firewall rule override is clearly stepping off the limits of what containerization should provoke.