5 ms·

No they shouldn't, just how nginx shouldn't manipulate iptables just because you've said it should listen to 443 on "the network". Many times you don't even wa

• selfmodruntime 4y ago
  You‘re wrong. If you use a command line argument that explicitely states „this will publish this port in your firewall for convenience“, a command line argument which you shouldn‘t use anyway, then you‘re on your own. You choose to do this. Docker assumes that you know what you‘re doing. You‘re also wrong in your last paragraph. There is the - easy - option to expose the port on your loopback, and re route to the docker bridge network by using a reverse proxy.
  • nickstinemates 4y ago
    This is exactly right. The alternative is ridiculous. Also, comparing expectations of Docker vs. something like nginx is crazy.
    • allarm 4y ago
      > the alternative is ridiculous. Like what is, having full control over your own system? I don’t think there’s anything wrong with not messing with my firewall and leaving this part to me. > is crazy And this is why, exactly?
      • Gordonjcp 4y ago
        How exactly do you *not* have full control of your system? Because typing in a command expressly designed to modify firewall rules... actually modifies firewall rules?
        • allarm 4y ago
          It’s not clearly stated in the docs, this is exactly how and why that happens.
          • Gordonjcp 4y ago
            It actually is, though, you just need to read them.
            • apple4ever 4y ago
              I read them. It's doesn't say that.
      • selfmodruntime 4y ago
        You do have full control over your system. You could choose not to install docker, for once.
• bionade24 4y ago
  You can prevent docker from doing that by editing its config, but you have to read the documentation to know that. As you have to, to actually know what a certain command does, too.
  • selfmodruntime 4y ago
    What horror. Now we actually have to read the documentation of potentially dangerous tools instead of guessing or following twitter tutorials.
• Gordonjcp 4y ago
  > No they shouldn't, just how nginx shouldn't manipulate iptables just because you've said it should listen to 443 on "the network". But you've typed in a command that explicitly will alter the iptables rules, as documented, and as you have requested > Many times you don't even want docker containers to go "to the network" directly and it shouldn't assume unsecure behaviour by default. Docker containers do not have a network connection outside their own subnet by default, and only expose the ports that they have explicitly been configured in the Dockerfile to expose. By determining the container's IP address you can talk to it directly but this is not really recommended, because it can and will change. This internal IP address is by default in an RFC1918 range, and will not be in any way accessible from the outside world. > Moreover, CRITICALLY, you can't prevent Docker from doing that and you can ONLY secure the machine by adding another rule on top that supresses Dockers rule... and those dockers rule change over time making it easy for the blocking hack to stop working after an update and again make the machine unsecure. You can prevent Docker from doing that, by not adding into the command line the additional option that tells it to hook containers up directly to the "outside world" interface bypassing any firewall you might set.