Selfhosted

61512 readers

833 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

105

Docker security (lemmy.zip)

submitted 8 months ago* (last edited 8 months ago) by jobbies@lemmy.zip to c/selfhosted@lemmy.world

48 comments fedilink hide all child comments

You're probably already aware of this, but if you run Docker on linux and use ufw or firewalld - it will bypass all your firewall rules. It doesn't matter what your defaults are or how strict you are about opening ports; Docker has free reign to send and receive from the host as it pleases.

If you are good at manipulating iptables there is a way around this, but it also affects outgoing traffic and could interfere with the bridge. Unless you're a pointy head with a fetish for iptables this will be a world of pain, so isn't really a solution.

There is a tool called ufw-docker that mitigates this by manipulating iptables for you. I was happy with this as a solution and it used to work well on my rig, but for some unknown reason its no-longer working and Docker is back to doing its own thing.

Am I missing an obvious solution here?

It seems odd for a popular tool like Docker - that is also used by enterprise - not to have a pain-free way around this.

you are viewing a single comment's thread
view the rest of the comments

[–] mhzawadi@lemmy.horwood.cloud 9 points 8 months ago (1 children)

sure, you can see below that port 53 is only on a secondary IP I have on my docker host.

***
services:
  pihole01:
    image: pihole/pihole:latest
    container_name: pihole01
    ports:
      - "8180:80/tcp"
      - "9443:443/tcp"
      - "192.168.1.156:53:53/tcp" # this will only bind to that IP
      - "192.168.1.156:53:53/udp" # this will only bind to that IP
      - "192.168.1.156:67:67/udp" # this will only bind to that IP
    environment:
      TZ: 'Europe/London'
      FTLCONF_webserver_api_password: 'mysecurepassword'
      FTLCONF_dns_listeningMode: 'all'
    dns:
      - '127.0.0.1'
      - '192.168.1.1'
    restart: unless-stopped
    labels:
        - "traefik.http.routers.pihole_primary.rule=Host(`dns01.example.com`)"
        - "traefik.http.routers.pihole_primary.service=pihole_primary"
        - "traefik.http.services.pihole_primary.loadbalancer.server.port=80"

[–] jobbies@lemmy.zip 2 points 8 months ago

Thanks, I'm embarrassed that I didn't know about this already 😅