Comment on What steps do you take to secure your server and your selfhosted services?
ikidd@lemmy.world 2 days agoI assume #2 is just to keep containers/stacks able to talk to each other without piercing the firewall for ports that aren’t to be exposed to the outside? It wouldn’t prevent anything if one of the containers on that host were compromised, afaik.
It’s mostly to allow the reverse proxy on localhost to connect to the container/service, while blocking all other hosts/IPs.
This is especially important when using docker as it messes with iptables and can circumvent firewall like e.g. ufw.
You’re right that it doesn’t increase security on case of a compromised container. It’s just about outside connections.
OK, yah, that’s what I was getting at.
MangoPenguin@lemmy.blahaj.zone 2 days ago
Containers can talk to each other without any ports exposed at all, they just need to be added to the same docker network.
ikidd@lemmy.world 2 days ago
I was getting more at stacks on a host talking, ie: you have a postgres stack with PG and Pgadmin, but want to use it with other stacks or k8s swarm, without exposing the pg port outside the machine.
MangoPenguin@lemmy.blahaj.zone 2 days ago
You can do that by joining the containers to the same docker network, you don’t need to expose ports even to localhost.
ikidd@lemmy.world 2 days ago
I mustn’t be communicating well, but that’s fine.