3 ms·
You should consider yourself lucky that you didn't lose your users data. My 2c: - NEVER expose a database to the public. Use at least a micro-service BFEs tha
by de6u99er 4y ago
You should consider yourself lucky that you didn't lose your users data.
My 2c:
- NEVER expose a database to the public. Use at least a micro-service BFEs that do exactly what the app needs and nothing more.
- Use a load balancer/gateway between your servers and the outside world (only port 80 and 443 should be open, 80 should redirect to 443).
- Use Docker-(Compose) as runtime/orchestrator only for development. For production use hardened cloud runtimes (e.g. Google Cloud Run, k3s/k8s, ...) with zero trust as default setting. Adhere to best practices!
- Before migrating production data, make sure everything works and nothing is exposed to the webs.
Tbh. I think your blog post is ridiculous, because IMHO the whole thing is your fault.
- revskill 4y agoI think even "better best practices" should be something like this: Even in case we accidently violate some security rules (like open ports,...) the application is still safe ?
- yjftsjthsd-h 4y ago> NEVER expose a database to the public They didn't intentionally expose the database; they thought that it was safe and docker bypassed their security. > because IMHO the whole thing is your fault How so? They had a working firewall, and then docker bypassed it, which they had no way of knowing to expect.