Comment on My Homelab Got Hacked - A Postmortem – Phunky Cafe
IanTwenty@piefed.social 4 days ago
Firewalling containers’ outbound access seems to be rare but another powerful layer of protection
Comment on My Homelab Got Hacked - A Postmortem – Phunky Cafe
IanTwenty@piefed.social 4 days ago
Firewalling containers’ outbound access seems to be rare but another powerful layer of protection
chaospatterns@lemmy.world 4 days ago
Yeah it’s useful and I’ve been using it for my home lab, but too many of my containers want outbound connections to the Internet. Like Forgejo needs :443 to be able to mirror or remote push repositories, so either I have to identify and allow list github.com, gitlab.com, etc. or end up allowing 0.0.0.0/0:443 which is not very strong protection.
I’d love for some kind of CNI or network plugin that filtered based on domain name.
moonshine69@lemmy.nz 4 days ago
Envoy is what i use, or squid is an option