Comment on PSA: Docker nukes your firewall rules, and replaces them with its own.
wreckedcarzz@lemmy.world 8 months agoSo uh, I just spun up a vps a couple days ago, few docker containers, usual security best practices… I used ufw to block all and open only ssh and a couple others, as that’s what I’ve been told that I need to do. Should I be panicking about my containers fucking with the firewall?
Docker will have only exposed container ports if you told it to.
If you used -p 8080:80 (cli) or - 8080:80 (docker-compose) then docker will have dutifully NAT’d those ports through your firewall. You can either not do either of those if it’s a port you don’t want exposed or as @moonpiedumplings@programming.dev says below you can ensure it’s only mapped to localhost (or an otherwise non-public) IP.
Thanks - more detailed reply below :)
moonpiedumplings@programming.dev 8 months ago
Probably not an issue, but you should check. If the port opened is something like
127.0.0.1:portnumber, then it’s only bound to localhost, and only that local machine can access it. If no address is specified, then anyone with access to the server can access that service.An easy way to see containers running is:
docker ps, where you can look at forwarded ports.Alternatively, you can use the
nmaptool to scan your own server for exposed ports.nmap -A serveripdoes the slowest, but most indepth scan.wreckedcarzz@lemmy.world 8 months ago
Just waking up, I’ve been running docker on my nas for a few years now and was never made aware of this - the nas ports appear safe, but the vps is not, so I swapped in
127.0.0.1in front of the port number (so it’s now127.0.0.1:8080:80or what have you), and that appears to resolve it. I have nginx running so of course that’s how I want to have a couple things exposed, not everything via port.My understanding was that port:port just was local for allowing redirection from container to host, and you’d still need to do network firewall management yourself to allow stuff through, and that appears the case on my home network, so I never had reason to question it. Thanks, I learned something today :)
Might do the same to my nas containers, too, just to be safe. I’m using those containers as a testbed for the vps containers so I don’t want to forget…