News for hackers. Stuff that matters.

A comment on Dockerfile Security Best Practices. Parent comment

Re:Dockerfile Security Best Practices by l3s2d on Wednesday October 14, 2020 @05:08PM (#24781630)
This has been a major pain point for me. Despite my `firewalld` configuration only allowing specific traffic, all my containers were exposed.

My current policy is to set `"iptables": false` in Docker's `daemon.json` on any public machine. I don't understand why this isn't the default.

[ Parent | on HN ]
Re:Dockerfile Security Best Practices by Nullabillity on Wednesday October 14, 2020 @06:26PM (#24782430)
> My current policy is to set `"iptables": false` in Docker's `daemon.json` on any public machine. I don't understand why this isn't the default.

If you don't muck with iptables then you need a (slow) userspace proxy to expose your pods. That also means losing things like the source IP address for any incoming connections.

[ Parent | on HN ]
Re:Dockerfile Security Best Practices by l3s2d on Wednesday October 14, 2020 @08:42PM (#24783499)
Interesting, I haven't noticed any slowdown, but I am running fairly low traffic services.

I do see that RemoteAddr is from a private IP range. Luckily I'm not using this information anywhere, but good to know.

[ Parent | on HN ]