3 ms·

>Everybody knows this. I didn't know this.

• teekert 1mo ago
  Do you know about docker compose overwriting your carefully set firewall rules? That’s the other docker thing…
  • dotancohen 1mo ago
    Go on, what other docker things should we know?
  • superq 1mo ago
    Absolutely. Docker is a boiling mess of baked-in convenience workarounds (ie vulns). It's an orchestration layer (like k8s with containers), not a real security boundary like VMs. OTOH, single-purpose VMs are basically just as easy these days and those can still pull in containers as needed.
• MrDresden 1mo ago
  Take a look at docker-socket-proxy as a somewhat of a counter to this issue: https://github.com/Tecnativa/docker-socket-proxy https://github.com/Tecnativa/docker-socket-proxy