3 ms·

Luckily, starting a local HTTP server for development is more-or-less a one-liner for a long time, in most OSes (maybe even Windows might ship with Python nowad

• 8organicbits 2y ago
  It's not perfect either: https://docs.python.org/3/library/http.server.html#http-server-security https://docs.python.org/3/library/http.server.html#http-serv... You should also add a `--bind 127.0.0.1` so you don't expose the site to everyone on your network.
  • diggan 2y ago
    Yeah, that's a good callout, thanks. Not sure why they took the less secure approach for something that is intended as a development environment, but I think I feel like that for lots of decisions in Python so maybe not that weird in the grand scheme of things.
  • jonhohle 2y ago
    That should really be the default behavior.
  • vindex10 2y ago
    Only slightly related, but port binding in Docker also binds to 0.0.0.0 by default: `-p 8000:8000` To be safe, this should be used instead: `-p 127.0.0.1:8000:8000`
    • janci 2y ago
      It also bypasses firewall (ufw on ubuntu)
      • rzzzt 2y ago
        Yes and no, it's modifying the NAT table and so traffic will not be subjected to inbound rules where you would normally add an "allow HTTPS"-style rule: https://docs.docker.com/engine/network/packet-filtering-firewalls/#docker-and-ufw https://docs.docker.com/engine/network/packet-filtering-fire...
        • diggan 2y ago
          In what way is that "No"? The docs say: > Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration. So docker is "effectively" ignoring your firewall in the case of ufw. I don't see how it can be considered to not ignoring your firewall when it ignores the rules you've setup.
          • rzzzt 2y ago
            NAT rules are still firewall (netfilter, iptables - note the plural) territory, ufw is a frontend for iptables to simplify creating rules. Does Docker violate the principle of least surprise? Yes. Was I bitten by this behavior? Definitely. Does it bypass the firewall? No.
            • diggan 2y ago
              I dunno. If I use UFW on Ubuntu, I use it as a firewall, and applications that ignores my firewall, I'd consider them to be ignoring my firewall, regardless if the details say that it's still using NAT rules so technically it's just ignoring one firewall/something not called a firewall, even though it ignores the firewall you've setup. To be frank, it kind of feels like the kind of technical nitpick argument I'd read from a Docker Inc employee trying to somehow defend ignoring the user's firewall. The end result is that you setup rules in UFW, and Docker ignores them.
• WorldMaker 2y ago
  > (maybe even Windows might ship with Python nowadays?) Windows doesn't ship with Python, but it does have a silly thing where if you type python in a command shell of your choice it will try to auto-install python. (When it works it is kind of magic, when it doesn't work it's a pain to debug the PATH problem.) It's not exactly a one-liner, but in an off-the-shelf Windows install it is a short script to create a simple static file web server inside PowerShell. Also there are npm and deno packages/CLIs that are easy to install/run for one-liners if you want to install something more "web native" than Python. `npx http-server` is an easy one-liner with any recent Node install.