6 ms·

Docker is not implicitly doing anything. The user requested for the port to get published and so docker published it. As nice as it would be for Docker to be m

Docker is not implicitly doing anything. The user requested for the port to get published and so docker published it. As nice as it would be for Docker to be more configurable in terms of where rules get inserted, that would not have helped here because the user already misconfigured things (should be using docker networks for db access). Technically docker even has a chain that you can throw rules into that will get hit before docker's rules... so it's there just very manual (instead of, say, having a ufw mode).

Tijdreiziger 4y ago
> The user requested for the port to get published and so docker published it. Yes, which runs counter to how every other application works. If you ask, say, sshd to listen on port 22, your firewall will still sit in front of it, unless you explicitly poke a hole in it.
- cpuguy83 4y ago
  Listening on a port and opening a port are different things. `-p` is for opening ports. Docker is not listening on behalf of the application. It is routing traffic to the application.
ilyt 4y ago
Docker is implicitly overriding existing rules by putting their own ones in front. The least it should do is to put a warning "hey, there are other rules here,I'm adding my own, please verify. It should also have option (I only found "complete on/complete off" one) to "just" create its DOCKER* chains and leave the jumping to them to the user
- cpuguy83 4y ago
  > I only found "complete on/complete off" one Docker has a `DOCKER-USER` chain where the user can inject their own rules before docker's rules are run. But even then, the user flat out should not be using `-p` unless they want to expose the service outside of the machine. That is the well documented networking model of docker. Docker also includes a network abstraction that should have been used here to give access to other services that need it and isolate it from the things that don't.
  - ilyt 4y ago
    Which is a terrible solution no firewall manager would support

Tijdreiziger 4y ago

> The user requested for the port to get published and so docker published it. Yes, which runs counter to how every other application works. If you ask, say, sshd to listen on port 22, your firewall will still sit in front of it, unless you explicitly poke a hole in it.

cpuguy83 4y ago
Listening on a port and opening a port are different things. `-p` is for opening ports. Docker is not listening on behalf of the application. It is routing traffic to the application.

ilyt 4y ago

Docker is implicitly overriding existing rules by putting their own ones in front. The least it should do is to put a warning "hey, there are other rules here,I'm adding my own, please verify. It should also have option (I only found "complete on/complete off" one) to "just" create its DOCKER* chains and leave the jumping to them to the user

cpuguy83 4y ago
> I only found "complete on/complete off" one Docker has a `DOCKER-USER` chain where the user can inject their own rules before docker's rules are run. But even then, the user flat out should not be using `-p` unless they want to expose the service outside of the machine. That is the well documented networking model of docker. Docker also includes a network abstraction that should have been used here to give access to other services that need it and isolate it from the things that don't.
- ilyt 4y ago
  Which is a terrible solution no firewall manager would support