4 ms·

It's not perfect either: https://docs.python.org/3/library/http.server.html#http-server-security https://docs.python.org/3/library/http.server.html#http-serv..

It's not perfect either: https://docs.python.org/3/library/http.server.html#http-server-security https://docs.python.org/3/library/http.server.html#http-serv... You should also add a `--bind 127.0.0.1` so you don't expose the site to everyone on your network.

diggan 2y ago
Yeah, that's a good callout, thanks. Not sure why they took the less secure approach for something that is intended as a development environment, but I think I feel like that for lots of decisions in Python so maybe not that weird in the grand scheme of things.
jonhohle 2y ago
That should really be the default behavior.
vindex10 2y ago
Only slightly related, but port binding in Docker also binds to 0.0.0.0 by default: `-p 8000:8000` To be safe, this should be used instead: `-p 127.0.0.1:8000:8000`
- janci 2y ago
  It also bypasses firewall (ufw on ubuntu)
  - rzzzt 2y ago
    Yes and no, it's modifying the NAT table and so traffic will not be subjected to inbound rules where you would normally add an "allow HTTPS"-style rule: https://docs.docker.com/engine/network/packet-filtering-firewalls/#docker-and-ufw https://docs.docker.com/engine/network/packet-filtering-fire...
    - diggan 2y ago
      In what way is that "No"? The docs say: > Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration. So docker is "effectively" ignoring your firewall in the case of ufw. I don't see how it can be considered to not ignoring your firewall when it ignores the rules you've setup.
      - rzzzt 2y ago
        NAT rules are still firewall (netfilter, iptables - note the plural) territory, ufw is a frontend for iptables to simplify creating rules. Does Docker violate the principle of least surprise? Yes. Was I bitten by this behavior? Definitely. Does it bypass the firewall? No.
        diggan 2y ago
        I dunno. If I use UFW on Ubuntu, I use it as a firewall, and applications that ignores my firewall, I'd consider them to be ignoring my firewall, regardless if the details say that it's still using NAT rules so technically it's just ignoring one firewall/something not called a firewall, even though it ignores the firewall you've setup. To be frank, it kind of feels like the kind of technical nitpick argument I'd read from a Docker Inc employee trying to somehow defend ignoring the user's firewall. The end result is that you setup rules in UFW, and Docker ignores them.

diggan 2y ago

Yeah, that's a good callout, thanks. Not sure why they took the less secure approach for something that is intended as a development environment, but I think I feel like that for lots of decisions in Python so maybe not that weird in the grand scheme of things.

jonhohle 2y ago

That should really be the default behavior.

vindex10 2y ago

Only slightly related, but port binding in Docker also binds to 0.0.0.0 by default: `-p 8000:8000` To be safe, this should be used instead: `-p 127.0.0.1:8000:8000`

janci 2y ago
It also bypasses firewall (ufw on ubuntu)
- rzzzt 2y ago
  Yes and no, it's modifying the NAT table and so traffic will not be subjected to inbound rules where you would normally add an "allow HTTPS"-style rule: https://docs.docker.com/engine/network/packet-filtering-firewalls/#docker-and-ufw https://docs.docker.com/engine/network/packet-filtering-fire...
  - diggan 2y ago
    In what way is that "No"? The docs say: > Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration. So docker is "effectively" ignoring your firewall in the case of ufw. I don't see how it can be considered to not ignoring your firewall when it ignores the rules you've setup.
    - rzzzt 2y ago
      NAT rules are still firewall (netfilter, iptables - note the plural) territory, ufw is a frontend for iptables to simplify creating rules. Does Docker violate the principle of least surprise? Yes. Was I bitten by this behavior? Definitely. Does it bypass the firewall? No.
      - diggan 2y ago
        I dunno. If I use UFW on Ubuntu, I use it as a firewall, and applications that ignores my firewall, I'd consider them to be ignoring my firewall, regardless if the details say that it's still using NAT rules so technically it's just ignoring one firewall/something not called a firewall, even though it ignores the firewall you've setup. To be frank, it kind of feels like the kind of technical nitpick argument I'd read from a Docker Inc employee trying to somehow defend ignoring the user's firewall. The end result is that you setup rules in UFW, and Docker ignores them.