2 ms·
I agree this is surprising behavior. Other comments have placed blame at the feet of Docker, iptables, or Ufw. However the easiest workaround is to tell docker
by hackyhacky 3y ago
I agree this is surprising behavior. Other comments have placed blame at the feet of Docker, iptables, or Ufw. However the easiest workaround is to tell docker to publish the ports ONLY on 127.0.0.1, making them inaccessible from elsewhere:
- ports:
127.0.0.1:8000:8000
- heywoodlh 3y agoI have found that another long-term solution is to switch to rootless Docker[0] or Podman for local dev. That way iptables isn't mangled with because you don't elevate to a privileged user to use it. Not being privileged has some downsides, but I think the tradeoffs are worth it. Docker Desktop and Rancher Desktop also is great on Linux for this reason, although, they both require a desktop environment. (Not disagreeing with your point -- yours is a great/quick workaround -- it just seems that many people don't know about rootless Docker) [0] https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/
- jvda 3y agoI don‘t get this. What‘s the point of publishing them on some port if you don‘t that to be.. well, public?
- hackyhacky 3y agoDocker lets you publish services for consumption by other services in your application. You don't necessarily want all of those services to be accessible to the whole world. Database, for example.