← Back to context

Comment by throwawaypath

2 months ago

This has been a known Docker "feature" since the beginning, nothing new here. This pattern is used to configure host machines by some tools.

23 comments

throwawaypath

Reply
pqdbr  2 months ago

Like the known Docker "feature" that it completely bypasses UFW and unless your ports look like "- 127.0.0.1:PORT:PORT" (and many of the examples use "-PORT:PORT") you expose everything to the internet?

  • byhemechi  2 months ago

    This is not a "feature", it's just a by-product of how iptables works. The alternative would be to have a proxy run in userspace, instead of letting the kernel forward packets

  • Root_Denied  2 months ago

    My understanding is that docker will expose the ports to the host machine's network interfaces, which is a crucial difference. For my home server running docker that means exposed to the LAN, but not the WAN unless I add in a port forwarding rule on my router. Similarly in an enterprise environment you would be exposing the port on whatever VLAN the host is connected to, which hopefully doesn't have directly transit to the open internet.

    Anything you're running on the perimeter with open access to the internet in an enterprise environment probably (hopefully) isn't running docker containers without some additional config and protections.

    • itintheory  2 months ago

      I was thinking along similar lines to what you've suggested here, but then I considered how many VPS might be configured by folks following some random web tutorial, to set up their LAMP stack (or whatever), that end up doing something like what was described.

      4 replies →

canadaduane  2 months ago

Isn't this one of the main improvements that Podman has over Docker?

  • 0xbadcafebee  2 months ago

    No, Docker can run rootless too

    • righthand  2 months ago

      This was not always true and running rootless has been a benefit of Podman for a long time. Docker also does not run rootless by default afaik, thus making the attack surface greater by default.

      The other main improvement of Podman over Docker is that Podman is daemonless and therefor is incredibly lightweight and portable.

      6 replies →