---
description: Docker published ports must bind to localhost only on this Oracle host (iptables/Caddy/Rathole)
alwaysApply: true
---

# Docker + iptables: localhost-only publishes

Docker modifies iptables and creates chains such as `DOCKER`, `DOCKER-FORWARD`, and `DOCKER-USER`. Published container ports can bypass some host-firewall assumptions.

Do **not** assume:

```bash
docker run -p 8080:8080 ...
```

is protected by the host `INPUT REJECT` the way an ordinary host process is. Oracle firewall rules remain, but Docker port publishing is a different path.

## Hard rule

Bind **all** Docker published ports to localhost unless the user explicitly requests public exposure:

```bash
# Required default
docker run -p 127.0.0.1:8080:8080 ...

# Do not use by default
docker run -p 8080:8080 ...
```

Compose equivalent:

```yaml
ports:
  - "127.0.0.1:8080:8080"
```

Caddy/Rathole can reach localhost; Internet clients must not hit containers directly. Public ingress stays on intentionally opened host ports (80/443, Rathole, etc.).

## Checklist

- Before adding containers with published ports: `sudo iptables -L -n -v`
- Confirm `DOCKER*` chains coexist with the Oracle firewall
- Prefer `DOCKER-USER` for extra Docker firewall policy
- Never publish `0.0.0.0:PORT` / bare `-p HOST:CONTAINER` without explicit user approval