3 ms·
Routable != routed. If your containers have a Global Unicast Address then it's possible to look at connetion logs and figure out which container made a particu
by yrro 11mo ago
Routable != routed.
If your containers have a Global Unicast Address then it's possible to look at connetion logs and figure out which container made a particular request, for instance.
- matt-p 11mo agoYes, not addressable is even safer. Especially so for someone not specialized in networking.
- yrro 11mo agoIt's not safer: it impedes observability.
- matt-p 11mo agoIt doesn't impeed observability for goodness sakes. It does however impeed accidentally opening up your internal network because you don't really understand your firewall/virtual router/whatever.
- yrro 11mo agoOf course it impedes observability. With IPv6, I can see the IP addresses of the containers that connect to a service. With IPv4, I get (at best) the IP address of the container host, thanks to NAT. Are you also afraid of port forwarding? Have you considered that your ISP could choose to send your router packets destined for RFC1918 addresses?
- speedgoose 11mo agoYes I see the value there. I'm not sure I'm ready to take the risk, and most of the traffic is IPv4 anyway, but that's a good point.