553
Context: Docker bypasses all UFW firewall rules (lemmy.world)
submitted 1 year ago* by to c/programmer_humor@programming.dev
104 comments fedilink hide all child comments
 

Docker docs:

Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

you are viewing a single comment's thread
view the rest of the comments
[–] [S] 18 points 1 year ago (3 children)

ufw just manages iptables rules, if docker overrides those it's on them IMO

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 10 points 1 year ago (2 children)

    Feels weird that an application is allowed to override iptables though. I get that when it's installed with root everything's off the table, but still....

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 6 points 1 year ago (2 children)

    Linux lets you do whatever you want and that's a side effect of it, there's nothing preventing an app from messing with things it shouldn't.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 6 points 1 year ago

    Not really.

    Both docker and ufw edit iptables rules.

    If you instruct docker to expose a port, it will do so.

    If you instruct ufw to block a port, it will only do so if you haven't explicitly exposed that port in docker.

    Its a common gotcha but it's not really a shortcoming of docker.

  • permalink
  • fedilink
  • source
  • parent