Even better, docker-compose doesn't do IPV6 (well). But if you have an IPV6 address, it will NAT all the incoming IPV6 traffic on the open ports to IPV4 using the internal network gateway address.

So, if you're doing any filtering for internal network addresses == internal traffic, congratulations, now your inbound external IPV6 traffic is recognized as internal.

And even better 0.0.0.0 isn’t the default on Docker For Mac, leading devs to a false sense of security who develop on Macs.

Is there any additional information on this?

Assuming I add a rule via

`iptables -I INPUT -s 123.123.123.123 -p tcp --dport 8080 -j DROP`

and on interface:port 0.0.0.0:8080 of the host is a container listening which got run as

`docker run -d -p 0.0.0.0:8080:8080 some/server:latest`

Will that container still be accessible to 123.123.123.132?

I think so, this has been discussed in many HN threads and it always surprises a lot of people how big of a hole this is. I was certainly not aware of it the first time I read about it. Docker inserts its own iptables rules before your drop rule I think to handle its virtual interfaces.

The Docker container is using a separate network namespace with a separate virtual interface that packets are routed to. The "PREROUTING" chain runs before the "INPUT" chain so yes, the rules you put in "INPUT" won't apply.

Its rules also go into the "nat" table instead of the "filter" table. Use "iptables -L -t nat" to display them.

Or iptables-save (note the nat and filter sections)

Yes. Docker will create specific rules for the lifetime of the container.

I was bit by this once. Be very careful with docker. Do not rely blindly on your firewall of it runs on the same machine.

Well, trick question since you typo'd the IP, but "yes" to the spirit. I ran into exactly the case described https://www.techrepublic.com/article/how-to-fix-the-docker-a..., albeit with mysql instead of mongo.

Strange, I've never seen this before. I've been running Docker for years on one of my pet project machines, but while Docker is exposing the ports on 0.0.0.0 my iptables firewall blocks all of them.

I'm not using --iptables=false but I'm not discounting the possibility that maybe I've configured this on a more global level somewhere.

That is still strange ; as you can read from others, docker refreshes it’s own iptable rules which then can mess with your own. Maybe you were lucky but seems unlikely to have that much luck. Be careful anyway; if you opened a port, it’ll be on 0.0.0.0 and docker does rearrange your iptables when the container(s) start. Especially default redis and mongo are good foot-shooters.

I don't quite understand it either. I just triple checked though, the ports are filtered from the outside. I do have a bunch of "docker network isolation" things going on in my iptables setup, so maybe that's why.

We unknowingly did this at work. We had firewalls in place and docker was more than happy to open up redis to the world. Big lesson learned.