I use nftables to set my firewall rules. I typically manually configure the rules myself. Recently, I just happened to dump the ruleset, and, much to my surprise, my config was gone, and it was replaced with an enourmous amount of extremely cryptic firewall rules. After a quick examination of the rules, I found that it was Docker that had modified them. And after some brief research, I found a number of open issues, just like this one, of people complaining about this behaviour. I think it’s an enourmous security risk to have Docker silently do this by default.
I have heard that Podman doesn’t suffer from this issue, as it is daemonless. If that is true, I will certainly be switching from Docker to Podman.
Just waking up, I’ve been running docker on my nas for a few years now and was never made aware of this - the nas ports appear safe, but the vps is not, so I swapped in
127.0.0.1in front of the port number (so it’s now127.0.0.1:8080:80or what have you), and that appears to resolve it. I have nginx running so of course that’s how I want to have a couple things exposed, not everything via port.My understanding was that port:port just was local for allowing redirection from container to host, and you’d still need to do network firewall management yourself to allow stuff through, and that appears the case on my home network, so I never had reason to question it. Thanks, I learned something today :)
Might do the same to my nas containers, too, just to be safe. I’m using those containers as a testbed for the vps containers so I don’t want to forget…