I looked through attacks in my access logs

Re:I looked through attacks in my access logs by ggpsv on Sunday January 28, 2024 @11:14AM (#39167039)

Docker is great but it is easy to shoot yourself on the foot if you use it conveniently but don't actually understand it.

A common mistake is to publish the Docker ports unknowingly to all interfaces (e.g `5432:5432`), which makes your Docker container available to everyone. It is common to see this in Docker tutorials or pre-made Docker Compose files. Coupled with UFW, it may give you a false sense of security because Docker manages its own iptables rules.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by elashri on Sunday January 28, 2024 @11:28AM (#39167195)

I do make the habit of not expose ports and just use reverse proxy for the container. Of course, you will need a bridged network between the reverse proxy container and the target container, but that's fine. I'm sure there is more clever ways around that.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by ggpsv on Sunday January 28, 2024 @11:55AM (#39167492)

I prefer to run the webserver using systemd on the host so publishing the container port to 127.0.0.1 is enough for me.

[ Parent | on HN ]

Re:I looked through attacks in my access logs by mfashby on Sunday January 28, 2024 @04:28PM (#39169981)

Yes I've made this mistake with docker and UFW before :( Such a footgun.

[ Parent | on HN ]