Comment on PSA: Docker nukes your firewall rules, and replaces them with its own.

• moonpiedumplings@programming.dev ⁨8⁩ ⁨months⁩ ago

  Dockers manipulation of nftables is pretty well defined in their documentation

  Documentation people don’t read. People expect, that, like most other services, docker binds to ports/addresses behind the firewall. Literally no other container runtime/engine does this, including, notably, podman.

  As to the usage of the docker socket that is widely advised against unless you really know what you’re doing.

  Too bad people don’t read that advice. They just deploy the webtop docker compose, without understanding what any of it is. I like (hate?) linuxserver’s webtop, because it’s an example of the two of the worst footguns in docker in one

  To include the rest of my comment that I linked to:

  Do any of those poor saps on zoomeye expect that I can pwn them by literally opening a webpage?

  No. They expect their firewall to protect them by not allowing remote traffic to those ports. You can argue semantics all you want, but not informing people of this gives them another footgun to shoot themselves with. Hence, docker “bypasses” the firewall.

  On the other hand, podman respects your firewall rules. Yes, you have to edit the rules yourself. But that’s better than a footgun. The literal point of a firewall is to ensure that any services you accidentally have running aren’t exposed to the internet, and docker throws that out the window.

  Your original point was:

  I think from the dev’s point of view (not that it is right or wrong), this is intended behavior simply because if docker didn’t do this, they would get 1,000 issues opened per day of people saying containers don’t work when they forgot to add a firewall rules for a new container.

  And I’m trying to say that even if that was true, it would still be better than a footgun where people expose stuff that’s not supposed to be exposed.

  But that isn’t the case for podman. A quick look through the github issues for podman, and I don’t see it inundated with newbies asking “how to expose services?” because they assume the firewall port needs to be opened, probably. Instead, there are bug reports in the opposite direction, like this one, where services are being exposed despite the firewall being up.

  source

  • adam@doomscroll.n8e.dev ⁨8⁩ ⁨months⁩ ago

    Documentation people don’t read Too bad people don’t read that advice

    Sure, I get it, this stuff should be accessible for all. Easy to use with sane defaults and all that. But at the end of the day anyone wanting to using this stuff is exposing potential/actual vulenerabilites to the internet (via the OS, the software stack, the configuration, … ad nauseum), and the management and ultimate responsibility for that falls on their shoulders.

    If they’re not doing the absolute minimum of R’ingTFM for something as complex as Docker then what else has been missed?

    People expect, that, like most other services, docker binds to ports/addresses behind the firewall

    Unless you tell it otherwise that’s exactly what it does. If you don’t bind ports good luck accessing your NAT’d 172.17.0.x:3001 service from the internet. Podman has the exact same functionality.

    source