Containers can talk to each other without any ports exposed at all, they just need to be added to the same docker network.
Comment on What steps do you take to secure your server and your selfhosted services?
ikidd@lemmy.world 11 months agoI assume #2 is just to keep containers/stacks able to talk to each other without piercing the firewall for ports that aren’t to be exposed to the outside? It wouldn’t prevent anything if one of the containers on that host were compromised, afaik.
MangoPenguin@lemmy.blahaj.zone 11 months ago
ikidd@lemmy.world 11 months ago
I was getting more at stacks on a host talking, ie: you have a postgres stack with PG and Pgadmin, but want to use it with other stacks or k8s swarm, without exposing the pg port outside the machine.
MangoPenguin@lemmy.blahaj.zone 11 months ago
You can do that by joining the containers to the same docker network, you don’t need to expose ports even to localhost.
ikidd@lemmy.world 11 months ago
I mustn’t be communicating well, but that’s fine.
Chewy7324@discuss.tchncs.de 11 months ago
It’s mostly to allow the reverse proxy on localhost to connect to the container/service, while blocking all other hosts/IPs.
This is especially important when using docker as it messes with iptables and can circumvent firewall like e.g. ufw.
You’re right that it doesn’t increase security on case of a compromised container. It’s just about outside connections.
ikidd@lemmy.world 11 months ago
OK, yah, that’s what I was getting at.