4 ms·

As far as I know, Docker still punches through your firewall by default. I consider that a pretty big negative against assuming secure-by-design.

yjftsjthsd-h 3y ago
What attack are you envisioning that is aided by docker bypassing firewall rules?
- fbdab103 3y ago
  I mean, there was this story[0] ("How a Docker footgun led to a vandal deleting NewsBlur's MongoDB database") about how the Docker rules allowed a hacker to delete someone's database. >Turns out the ufw firewall I enabled and diligently kept on a strict allowlist with only my internal servers didn’t work on a new server because of Docker. When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world. So while my firewall was “active”, doing a sudo iptables -L | grep 27017 showed that MongoDB was open the world. This has been a Docker footgun since 2014. Story was previously discussed on HN[1]. Sure, you could argue the author should have done more to secure the endpoint, but this was 100% a failure mode due to how Docker prioritizes convenience over security. [0] https://blog.newsblur.com/2021/06/28/story-of-a-hacking/ https://blog.newsblur.com/2021/06/28/story-of-a-hacking/ [1] https://news.ycombinator.com/item?id=27670058 https://news.ycombinator.com/item?id=27670058
- pella 3y ago
  Weak password + Open ports ---> Malware attack ( kinsing , etc ) so use "-p 127.0.0.1:5432:5432" - https://github.com/docker-library/postgres/issues/770 https://github.com/docker-library/postgres/issues/770 - https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi - https://sysdig.com/blog/cloud-defense-in-depth/ https://sysdig.com/blog/cloud-defense-in-depth/ - https://thenewstack.io/kinsing-malware-targets-kubernetes/ https://thenewstack.io/kinsing-malware-targets-kubernetes/ - https://stackoverflow.com/search?q=kinsing https://stackoverflow.com/search?q=kinsing - https://github.com/search?q=repo%3Adocker-library%2Fpostgres+malware&type=issues https://github.com/search?q=repo%3Adocker-library%2Fpostgres... ----------- https://docs.docker.com/network/packet-filtering-firewalls/ https://docs.docker.com/network/packet-filtering-firewalls/ "On Linux, Docker manipulates iptables rules to provide network isolation. While this is an implementation detail and you should not modify the rules Docker inserts into your iptables policies, it does have some implications on what you need to do if you want to have your own policies in addition to those managed by Docker. If you're running Docker on a host that is exposed to the Internet, you will probably want to have iptables policies in place that prevent unauthorized access to containers or other services running on your host. This page describes how to achieve that, and what caveats you need to be aware of."

yjftsjthsd-h 3y ago

What attack are you envisioning that is aided by docker bypassing firewall rules?

fbdab103 3y ago
I mean, there was this story[0] ("How a Docker footgun led to a vandal deleting NewsBlur's MongoDB database") about how the Docker rules allowed a hacker to delete someone's database. >Turns out the ufw firewall I enabled and diligently kept on a strict allowlist with only my internal servers didn’t work on a new server because of Docker. When I containerized MongoDB, Docker helpfully inserted an allow rule into iptables, opening up MongoDB to the world. So while my firewall was “active”, doing a sudo iptables -L | grep 27017 showed that MongoDB was open the world. This has been a Docker footgun since 2014. Story was previously discussed on HN[1]. Sure, you could argue the author should have done more to secure the endpoint, but this was 100% a failure mode due to how Docker prioritizes convenience over security. [0] https://blog.newsblur.com/2021/06/28/story-of-a-hacking/ https://blog.newsblur.com/2021/06/28/story-of-a-hacking/ [1] https://news.ycombinator.com/item?id=27670058 https://news.ycombinator.com/item?id=27670058
pella 3y ago
Weak password + Open ports ---> Malware attack ( kinsing , etc ) so use "-p 127.0.0.1:5432:5432" - https://github.com/docker-library/postgres/issues/770 https://github.com/docker-library/postgres/issues/770 - https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi - https://sysdig.com/blog/cloud-defense-in-depth/ https://sysdig.com/blog/cloud-defense-in-depth/ - https://thenewstack.io/kinsing-malware-targets-kubernetes/ https://thenewstack.io/kinsing-malware-targets-kubernetes/ - https://stackoverflow.com/search?q=kinsing https://stackoverflow.com/search?q=kinsing - https://github.com/search?q=repo%3Adocker-library%2Fpostgres+malware&type=issues https://github.com/search?q=repo%3Adocker-library%2Fpostgres... ----------- https://docs.docker.com/network/packet-filtering-firewalls/ https://docs.docker.com/network/packet-filtering-firewalls/ "On Linux, Docker manipulates iptables rules to provide network isolation. While this is an implementation detail and you should not modify the rules Docker inserts into your iptables policies, it does have some implications on what you need to do if you want to have your own policies in addition to those managed by Docker. If you're running Docker on a host that is exposed to the Internet, you will probably want to have iptables policies in place that prevent unauthorized access to containers or other services running on your host. This page describes how to achieve that, and what caveats you need to be aware of."