dangling_cat comments on Context: Docker bypasses all UFW firewall rules

Context: Docker bypasses all UFW firewall rules (lemmy.world)

submitted 1 year ago* by qaz@lemmy.world to c/programmer_humor@programming.dev

104 comments fedilink hide all child comments

Docker docs:

Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

[–] dangling_cat@piefed.blahaj.zone 37 points 1 year ago (3 children)

I DIDNT KNOW THAT! WOW, this puts “not to use network_mode: host” another level.

permalink

fedilink

source

hideshow 3 child comments

[–] exu@feditown.com 17 points 1 year ago (1 child)

network: host gives the container basically full access to any port it wants. But even with other network modes you need to be careful, as any -p <external port>:<container port> creates the appropriate firewall rule automatically.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] AmbiguousProps@lemmy.today 3 points 1 year ago

I just use caddy and don't use any port rules on my containers. But maybe that's also problematic.

permalink

fedilink

source

parent

[–] greyfox@lemmy.world 3 points 1 year ago

Actually I believe host networking would be the one case where this isn't an issue. Docker isn't adding iptables rules to do NAT masquerading because there is no IP forwarding being done.

When you tell docker to expose a port you can tell it to bind to loopback and this isn't an issue.

permalink

fedilink

source

parent