PSA: Docker nukes your firewall rules, and replaces them with its own.

Submitted ⁨⁨8⁩ ⁨months⁩ ago⁩ by ⁨Kalcifer@sh.itjust.works⁩ to ⁨selfhosted@lemmy.world⁩

I use nftables to set my firewall rules. I typically manually configure the rules myself. Recently, I just happened to dump the ruleset, and, much to my surprise, my config was gone, and it was replaced with an enourmous amount of extremely cryptic firewall rules. After a quick examination of the rules, I found that it was Docker that had modified them. And after some brief research, I found a number of open issues just like this one of people complaining about this behaviour. I think it’s an enourmous security risk to have Docker silently do this by default.

I have heard that Podman doesn’t suffer from this issue, as it is daemonless. If that is true, I will certainly be switching from Docker to Podman.

source

Comments

Sort:hotnew top

Molecular0079@lemmy.world ⁨8⁩ ⁨months⁩ ago
If you use firewalld, both docker and podman apply rules in a special zone separate from your main one.

That being said, podman is great. Podman in rootful mode, along with podman-docker and docker-compose, is basically a drop-in replacement for Docker.

source
- Link@rentadrunk.org ⁨8⁩ ⁨months⁩ ago
  Is it? Last time I tried none of my docker compose files would start correctly in podman compose.
  
  source
  - SLaSZT@kbin.social ⁨8⁩ ⁨months⁩ ago
    I just set it up last week, it works exceptionally well.
    
    Did you also install podman-docker, make sure that the podman socket was running, and verify that the socket directory referenced in the config files was correct?
    
    Those are the 3 things that I got a bit stuck on. In the end, I RTFM and all was well.
    
    source
  - Molecular0079@lemmy.world ⁨8⁩ ⁨months⁩ ago
    podman-compose is different from docker-compose. It runs your containers in rootless mode. This may break certain containers if configured incorrectly. This is why I suggested podman-docker, which allows podman to emulate docker, and the native docker-compose tool. Then you use sudo docker-compose to run your compose files in rootful mode.
    
    source
    -> View More Comments
- dandroid@sh.itjust.works ⁨8⁩ ⁨months⁩ ago
  I’m a podman user, but what’s the point of using podman if you are going to use a daemon and run it as root? I like podman so I can specifically avoid those things.
  
  source
  - Molecular0079@lemmy.world ⁨8⁩ ⁨months⁩ ago
    I am using it as a migration tool tbh. I am trying to get to rootless, but some of the stuff I host just don’t work well in rootless yet, so I use rootful for those containers. Meanwhile, I am using rootless for dev purposes or when testing out new services that I am unsure about.
    
    Podman also has good integration into Cockpit, which is nice for monitoring purposes.
    
    source
zeluko@kbin.social ⁨8⁩ ⁨months⁩ ago
Yeah, it needs those rules for e.g. port-forwarding into the containers.
But it doesnt really 'nuke' existing ones.

I have simply placed my rules at higher priority than normal. Very simple in nftables and good to not have rules mixed between nftables and iptables in unexpected ways.
You should filter as early as possible anyways to reduce ressource usage on e.g. connection tracking.

source
- Kalcifer@sh.itjust.works ⁨8⁩ ⁨months⁩ ago
  
  But it doesnt really ‘nuke’ existing ones.
  
  How come I don’t see my previous rules when I dump the ruleset, then? I have my rules written in /etc/nftables.conf, and they were previously applied by running # nft -f /etc/nftables.conf. Now, when I dump the current ruleset with # nft list ruleset, those previous rules aren’t there — all I see are Docker’s rules.
  
  source
Auli@lemmy.ca ⁨8⁩ ⁨months⁩ ago
It doesn’t nuke your rules. Just ads to them.

source
- Kalcifer@sh.itjust.works ⁨8⁩ ⁨months⁩ ago
  How come I don’t see my previous rules when I dump the ruleset, then? I have my rules written in /etc/nftables.conf, and they were previously applied by running # nft -f /etc/nftables.conf. Now, when I dump the current ruleset with # nft list ruleset, those previous rules aren’t there — all I see are Docker’s rules.
  
  source
  - gorgori@lemmy.world ⁨8⁩ ⁨months⁩ ago
    You can use a bridge network or the host network.
    
    In bridge network it is like a NAT host. With its own firewall settings.
    
    In host network mode, it will just open the port it needs.
    
    source
    -> View More Comments
JustEnoughDucks@feddit.nl ⁨8⁩ ⁨months⁩ ago
This is standard, but often unwanted, behavior of docker.

Docker creates a bunch of chain rules, but IIRC, doesn’t modify actual incoming rules (at least it doesn’t for me) it just will make a chain rule for every internal docker network item to make sure all of the services can contact each other.

Yes it is a security risk, but if you don’t have all ports forwarded, someone would still have to breach your internal network IIRC, so you would have many many more problems than docker.

I think from the dev’s point of view (not that it is right or wrong), this is intended behavior simply because if docker didn’t do this, they would get 1,000 issues opened per day of people saying containers don’t work when they forgot to add a firewall rules for a new container.

Option to disable this behavior would be 100x better then current, but what do I know lol

source
- justJanne@startrek.website ⁨8⁩ ⁨months⁩ ago
  That assumes you’re on some VPS with a hardware firewall in front.
  
  Often enough you’re on a dedicated server that’s directly exposed to the internet, with those iptables rules being the only thing standing between your services and the internet.
  
  source
  - lemmyvore@feddit.nl ⁨8⁩ ⁨months⁩ ago
    What difference does it make if you open the ports yourself for the services you expose, or Docker does it for you? That’s all that Docker is meant to do, act as convenience so you don’t have to add/remove rules as the containers go up/down, or remember Docker interfaces.
    
    If by any chance you are making services listen on 0.0.0.0 and covering them up with a firewall that’s very bad practice.
    
    source
    -> View More Comments
- moonpiedumplings@programming.dev ⁨8⁩ ⁨months⁩ ago
  Yes it is a security risk, but if you don’t have all ports forwarded, someone would still have to breach your internal network IIRC, so you would have many many more problems than docker.
  
  I think from the dev’s point of view (not that it is right or wrong), this is intended behavior simply because if docker didn’t do this, they would get 1,000 issues opened per day of people saying containers don’t work when they forgot to add a firewall rules for a new container.
  
  My problem with this, is that when running a public facing server, this ends up with people exposing containers that really, really shouldn’t be exposed.
  
  Excerpt from another comment of mine:
  
  It’s only docker where you have to deal with something like this:
  
  --- services: webtop: image: lscr.io/linuxserver/webtop:latest container_name: webtop security_opt: - seccomp:unconfined #optional environment: - PUID=1000 - PGID=1000 - TZ=Etc/UTC - SUBFOLDER=/ #optional - TITLE=Webtop #optional volumes: - /path/to/data:/config - /var/run/docker.sock:/var/run/docker.sock #optional ports: - 3000:3000 - 3001:3001 restart: unless-stopped
  
  Originally from here, edited for brevity.
  
  Resulting in exposed services. Feel free to look at shodan or zoomeye, internet connected search engines, for exposed versions of this service. This service is highly dangerous to expose, as it gives people an in to your system via the docker socket.
  
  source
  - adam@doomscroll.n8e.dev ⁨8⁩ ⁨months⁩ ago
    But… You literally have ports rules in there. Rules that expose ports.
    
    You don’t get to grumble that docker is doing something when you’re telling it to do it
    
    Dockers manipulation of nftables is pretty well defined in their documentation. If you dig deep everything is tagged and natted through to the docker internal networks.
    
    As to the usage of the docker socket that is widely advised against unless you really know what you’re doing.
    
    source
    -> View More Comments
  - null@slrpnk.net ⁨8⁩ ⁨months⁩ ago
    My solution to this has been to not forward the ports on individual services at all. I put a reverse proxy in front of them, refer to them by container name in the reverse proxy settings, and make sure they’re on the same docker network.
    
    source
  - wreckedcarzz@lemmy.world ⁨8⁩ ⁨months⁩ ago
    So uh, I just spun up a vps a couple days ago, few docker containers, usual security best practices… I used ufw to block all and open only ssh and a couple others, as that’s what I’ve been told that I need to do. Should I be panicking about my containers fucking with the firewall?
    
    source
    -> View More Comments
- N0x0n@lemmy.ml ⁨8⁩ ⁨months⁩ ago
  
  Option to disable this behavior would be 100x better then current, but what do I know lol
  
  Prevent docker from manipulating iptables
  
  Don’t know what it’s actually doing, I’m just learning how to work with nftables, but I saved that link in case oneday I want to manage the iptables rules myself :)
  
  source
  - Auli@lemmy.ca ⁨8⁩ ⁨months⁩ ago
    Good luck. Your going to have to change the rules whenever the up address of the container changes.
    
    source
    -> View More Comments
- Kalcifer@sh.itjust.works ⁨8⁩ ⁨months⁩ ago
  
  IIRC, doesn’t modify actual incoming rules (at least it doesn’t for me)
  
  How come I don’t see my previous rules when I dump the ruleset, then? I have my rules written in /etc/nftables.conf, and they were previously applied by running # nft -f /etc/nftables.conf. Now, when I dump the current ruleset with # nft list ruleset, those previous rules aren’t there — all I see are Docker’s rules.
  
  source
N0x0n@lemmy.ml ⁨8⁩ ⁨months⁩ ago
You can somehow change that behavior: Prevent docker from manipulating iptables

source
onlinepersona@programming.dev ⁨8⁩ ⁨months⁩ ago
There’s also rootless docker. There shouldn’t be any more firewall shenanigans.

CC BY-NC-SA 4.0

source
BearOfaTime@lemm.ee ⁨8⁩ ⁨months⁩ ago
Wow, thanks for the heads up.

Looks like it affects dockerd, but not docker desktop.

Any idea of the docker implementation in Proxmox or TrueNAS? (TrueNAS does containers if I remember right?)

source
- hperrin@lemmy.world ⁨8⁩ ⁨months⁩ ago
  Correct me if I’m wrong, but I don’t think Proxmox uses Docker. I’m pretty sure its containers are LXC containers.
  
  source
  - Vendetta9076@sh.itjust.works ⁨8⁩ ⁨months⁩ ago
    Correct
    
    source
  - BearOfaTime@lemm.ee ⁨8⁩ ⁨months⁩ ago
    Oh, yea, you’re right. Thanks
    
    source
- ErwinLottemann@feddit.de ⁨8⁩ ⁨months⁩ ago
  ofcourse docker desktop is not affected because it’s a vm running docker running on your computer. the nftables inside the container are modified by docker
  
  source
Decronym@lemmy.decronym.xyz ⁨8⁩ ⁨months⁩ ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters

IP Internet Protocol

LXC Linux Containers

NAT Network Address Translation

VPS Virtual Private Server (opposed to shared hosting)

[Thread #589 for this sub, first seen 11th Mar 2024, 10:15] [FAQ] [Full list] [Contact] [Source code]

source
Dirk@lemmy.ml ⁨8⁩ ⁨months⁩ ago
So better put Docker in a VM so it can’t do any harm to the host?

source
- BearOfaTime@lemm.ee ⁨8⁩ ⁨months⁩ ago
  Lol.
  
  source
- taladar@sh.itjust.works ⁨8⁩ ⁨months⁩ ago
  It is enough to put it into its own network namespace.
  
  source
Shimitar@feddit.it ⁨6⁩ ⁨months⁩ ago
That’s another good reason to use podman, rules are on nft and separated from your rules.

source

Fewer Letters	More Letters
IP	Internet Protocol
LXC	Linux Containers
NAT	Network Address Translation
VPS	Virtual Private Server (opposed to shared hosting)