45 lines
1.3 KiB
Plaintext
45 lines
1.3 KiB
Plaintext
---
|
|
description: Docker published ports must bind to localhost only on this Oracle host (iptables/Caddy/Rathole)
|
|
alwaysApply: true
|
|
---
|
|
|
|
# Docker + iptables: localhost-only publishes
|
|
|
|
Docker modifies iptables and creates chains such as `DOCKER`, `DOCKER-FORWARD`, and `DOCKER-USER`. Published container ports can bypass some host-firewall assumptions.
|
|
|
|
Do **not** assume:
|
|
|
|
```bash
|
|
docker run -p 8080:8080 ...
|
|
```
|
|
|
|
is protected by the host `INPUT REJECT` the way an ordinary host process is. Oracle firewall rules remain, but Docker port publishing is a different path.
|
|
|
|
## Hard rule
|
|
|
|
Bind **all** Docker published ports to localhost unless the user explicitly requests public exposure:
|
|
|
|
```bash
|
|
# Required default
|
|
docker run -p 127.0.0.1:8080:8080 ...
|
|
|
|
# Do not use by default
|
|
docker run -p 8080:8080 ...
|
|
```
|
|
|
|
Compose equivalent:
|
|
|
|
```yaml
|
|
ports:
|
|
- "127.0.0.1:8080:8080"
|
|
```
|
|
|
|
Caddy/Rathole can reach localhost; Internet clients must not hit containers directly. Public ingress stays on intentionally opened host ports (80/443, Rathole, etc.).
|
|
|
|
## Checklist
|
|
|
|
- Before adding containers with published ports: `sudo iptables -L -n -v`
|
|
- Confirm `DOCKER*` chains coexist with the Oracle firewall
|
|
- Prefer `DOCKER-USER` for extra Docker firewall policy
|
|
- Never publish `0.0.0.0:PORT` / bare `-p HOST:CONTAINER` without explicit user approval
|