3 ms·

Am I missing something? The article wrote: > When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the wor

by nickjj 4y ago

Am I missing something? The article wrote: > When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world But the blog post doesn't mention how Docker "helpfully inserted an allow rule". Is this because NewsBlur ran the container using the -p 27017:27017 flag without reading the docs around what publishing a port does? You don't need to publish a port for (2) containers to talk to each other, they can do that over a private Docker network that both containers belong to (something Docker Compose does for you by default). You can also choose to -p 127.0.0.1:27017:27017 which will only publish the port so that only localhost can access it, something like this is handy if you publish a web port to localhost so nginx not running in Docker can connect to it.

nickstinemates 4y ago
> Is this because NewsBlur ran the container using the -p 27017:27017 flag without reading the docs around what publishing a port does? Yep, and ended up shifting blame to Docker by calling it a "footgun."
- nickjj 4y ago
  I think if this happened in 2014 it would be more accepted as a footgun since Docker was much less known then. But in 2021 they: - Ran their main DB in Docker without knowing the fundamentals of Docker - Shipped it to production without anyone catching it in a review process I mean, the incident isn't fun and I wish no one harm on their production data but this is like saying you never used Linux before, stumbled upon a prompt onto your production server, ran `rm -rf /var/lib/mongodb` and now you wrote a blog about how you're upset at Ken Thompson and Dennis Ritchie[0] because an `rm` footgun allowed you to delete your production database. Now, to be constructive about this. Can or should Docker do anything to help prevent this? Would adding a warning to the terminal output that you're opening a port to the outside world be worth it? That sort of feels like overkill. Maybe a Docker plugin could be created to add more text or extra protection through y/n prompts when running anything dangerous, such as `docker compose down -v`. But this feels like a scenario where someone would do the bad thing without protection, get bitten by it and then discover the plugin afterwards where it's too late. [0]: The creators of the `rm` tool.
remram 4y ago
Yeah I don't want to pretend that it's not a footgun, because it is a footgun and it should have defaulted to binding to 127.0.0.1... but it does not "insert an allow rule" or "override the firewall" or anything like that. It just uses forwarding rather than listening on a port, because container and virtual machines are not regular processes, and the iptables "nat" table is used before the "filter" table that his firewall uses. So I agree with you, the author is being very dishonest here.

by nickjj 4y ago

nickstinemates 4y ago

> Is this because NewsBlur ran the container using the -p 27017:27017 flag without reading the docs around what publishing a port does? Yep, and ended up shifting blame to Docker by calling it a "footgun."

nickjj 4y ago
I think if this happened in 2014 it would be more accepted as a footgun since Docker was much less known then. But in 2021 they: - Ran their main DB in Docker without knowing the fundamentals of Docker - Shipped it to production without anyone catching it in a review process I mean, the incident isn't fun and I wish no one harm on their production data but this is like saying you never used Linux before, stumbled upon a prompt onto your production server, ran `rm -rf /var/lib/mongodb` and now you wrote a blog about how you're upset at Ken Thompson and Dennis Ritchie[0] because an `rm` footgun allowed you to delete your production database. Now, to be constructive about this. Can or should Docker do anything to help prevent this? Would adding a warning to the terminal output that you're opening a port to the outside world be worth it? That sort of feels like overkill. Maybe a Docker plugin could be created to add more text or extra protection through y/n prompts when running anything dangerous, such as `docker compose down -v`. But this feels like a scenario where someone would do the bad thing without protection, get bitten by it and then discover the plugin afterwards where it's too late. [0]: The creators of the `rm` tool.

remram 4y ago

Yeah I don't want to pretend that it's not a footgun, because it is a footgun and it should have defaulted to binding to 127.0.0.1... but it does not "insert an allow rule" or "override the firewall" or anything like that. It just uses forwarding rather than listening on a port, because container and virtual machines are not regular processes, and the iptables "nat" table is used before the "filter" table that his firewall uses. So I agree with you, the author is being very dishonest here.