553
Context: Docker bypasses all UFW firewall rules (lemmy.world)
submitted 1 year ago* by to c/programmer_humor@programming.dev
104 comments fedilink hide all child comments
 

Docker docs:

Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

you are viewing a single comment's thread
view the rest of the comments
[–] 33 points 1 year ago (3 children)

It’s my understanding that docker uses a lot of fuckery and hackery to do what they do. And IME they don’t seem to care if it breaks things.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 33 points 1 year ago

    To be fair, the largest problem here is that it presents itself as the kind of isolation that would respect firewall rules, not that they don't respect them.

    People wouldn't make the same mistake in NixOS, despite it doing exactly the same.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 1 year ago

    I don’t know how much hackery and fuckery there is with docker specifically. The majority of what docker does was already present in the Linux kernel namespaces, cgroups etc. Docker just made it easier to build and ship the isolated environments between systems.

  • permalink
  • fedilink
  • source
  • parent