5 ms·

> Who that wise guy in Docket team who decided to pass default firewall rules and open containers ports to public? This is pure ignorance and slandering the Do

> Who that wise guy in Docket team who decided to pass default firewall rules and open containers ports to public? This is pure ignorance and slandering the Docker team for it seems weird.

yjftsjthsd-h 4y ago
What's ignorant about it? Or wrong, for that matter, since it can't be "slander" if it's true. Docker does bypass default firewall rules and expose container ports to the public. If I run anything else on a server (apache2, say), and tell it to bind to 0.0.0.0:80, it doesn't matter, because the firewall will block it. If I tell a docker container to bind to 0.0.0.0:80, it magically skips over any other protections and immediately exposes itself to the world.
- nickstinemates 4y ago
  How is it that you can spawn many containers and have them all bind to `0.0.0.0:80` in your example? Try doing the same with Apache2. Multiple instances listening on Port 80. This is the difference, and the source of ignorance.
  - yjftsjthsd-h 4y ago
    You... can't? I mean, you can bind it inside the container, of course, but you can't bind it on the host ("publish"), which seems like the analogous thing to running on the host. Also, AIUI podman manages to not ignore the firewall, so it's not like it's some inherent issue.
    - nickstinemates 4y ago
      You can. Because each container has its own ip address. Publish IS EXACTLY the creation of the iptables entry to route traffic over the docker0 bridge.
convolvatron 4y ago
thats a really weird take. the whole point of developing and using infrastructure projects like docker is to package up best practices and let other people leverage them without becoming experts themselves. maybe its fair to say that we shouldn't attempt to find an individual to blame. but that doesn't mean docker as an organization didnt screw up here
- nickstinemates 4y ago
  So in this case the best practice is to make UFW a dependency and delegate all routing to it? And if I don't want to use UFW or I am on a distro with another firewall, let alone an upstream firewall or other solution, tough luck?

> Who that wise guy in Docket team who decided to pass default firewall rules and open containers ports to public? This is pure ignorance and slandering the Docker team for it seems weird.

yjftsjthsd-h 4y ago

What's ignorant about it? Or wrong, for that matter, since it can't be "slander" if it's true. Docker does bypass default firewall rules and expose container ports to the public. If I run anything else on a server (apache2, say), and tell it to bind to 0.0.0.0:80, it doesn't matter, because the firewall will block it. If I tell a docker container to bind to 0.0.0.0:80, it magically skips over any other protections and immediately exposes itself to the world.

nickstinemates 4y ago
How is it that you can spawn many containers and have them all bind to `0.0.0.0:80` in your example? Try doing the same with Apache2. Multiple instances listening on Port 80. This is the difference, and the source of ignorance.
- yjftsjthsd-h 4y ago
  You... can't? I mean, you can bind it inside the container, of course, but you can't bind it on the host ("publish"), which seems like the analogous thing to running on the host. Also, AIUI podman manages to not ignore the firewall, so it's not like it's some inherent issue.
  - nickstinemates 4y ago
    You can. Because each container has its own ip address. Publish IS EXACTLY the creation of the iptables entry to route traffic over the docker0 bridge.

convolvatron 4y ago

thats a really weird take. the whole point of developing and using infrastructure projects like docker is to package up best practices and let other people leverage them without becoming experts themselves. maybe its fair to say that we shouldn't attempt to find an individual to blame. but that doesn't mean docker as an organization didnt screw up here

nickstinemates 4y ago
So in this case the best practice is to make UFW a dependency and delegate all routing to it? And if I don't want to use UFW or I am on a distro with another firewall, let alone an upstream firewall or other solution, tough luck?