Re:Show HN: Bunkerized-Nginx – Nginx Docker image secure by ...
by kenniskrag on Tuesday October 20, 2020 @06:33PM
(#24842994)
But you can also use a container as first contact and redirect to other containers. You can bind a network device to a container.
For example a reverse proxy container which redirects to a gitea container or a wordpress container depending on the request. The reverse proxy container can also centralize the security with certificate handling or fail2ban.
Re:Show HN: Bunkerized-Nginx – Nginx Docker image secure by ...
by rudasn on Tuesday October 20, 2020 @07:02PM
(#24843183)
You still need access to the host, via ssh for example, to start the containers and do some basic maintenance. Won't you have fail2ban installed on the host since your ssh port would be open?
Re:Show HN: Bunkerized-Nginx – Nginx Docker image secure by ...
by hermitmaster on Tuesday October 20, 2020 @07:22PM
(#24843311)
If you need direct access to the host, it’s probably a non production environment or you’re doing containers wrong. Kubernetes clusters provisioned with Terraform, for example, should almost never require ssh access to workers nodes.
To distribute security to the single images/VMs increases complexity and the likeliness that some image/VM will miss some security filter, and leaves the host itself unprotected (e.g. network time sync & ssh & other stuff will probably be running, any update to the host's SW might result in unexpected services running, etc...).
An additional (dedicated) layer of security in the images/VMs would of course still be ok.