docker and iptables

[Alex <mysqlstudent@xxxxxxxxx>]

Hi,

I'm using docker on fedora38 and can't figure out how to prevent port 8080 from being available to the outside world. I've done quite a bit of reading on this, and it appears I'm not the only one having trouble figuring this out. This docker doc appears to indicate it shouldn't be listening on the external port when the -p option is not used.

https://docs.docker.com/network/#the-world

Here's the output from the commands related to docker:

$ ps ax|grep docker
    748 ?        Ssl    0:01 /usr/bin/dockerd --host=fd:// --exec-opt native.cgroupdriver=systemd --selinux-enabled --log-driver=journald --live-restore --default-ulimit nofile=1024:1024 --init-path /usr/libexec/docker/docker-init --userland-proxy-path /usr/libexec/docker/docker-proxy
    882 ?        Ssl    0:00 containerd --config /var/run/docker/containerd/containerd.toml
   2785 ?        Sl     0:00 /usr/libexec/docker/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 8080 -container-ip 172.29.0.2 -container-port 1080
   2791 ?        Sl     0:00 /usr/libexec/docker/docker-proxy -proto tcp -host-ip :: -host-port 8080 -container-ip 172.29.0.2 -container-port 1080
   2807 ?        Sl     0:00 /usr/libexec/docker/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 8025 -container-ip 172.29.0.2 -container-port 1025
   2814 ?        Sl     0:00 /usr/libexec/docker/docker-proxy -proto tcp -host-ip :: -host-port 8025 -container-ip 172.29.0.2 -container-port 1025
   2829 ?        Sl     0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id c0de8bf0f713d568adcbb323ab3114b20e374cb32b0841e054fb5e24d48b4416 -address /var/run/docker/containerd/containerd.sock

I've tried creating an explicit rule that restricts access to port 8080 on all interfaces except for localhost, but scanning that port externally still shows it's available.

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination        
    0     0 DROP       6    --  enp1s0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080
    0     0 DROP       6    --  br-a6d9c4747d4e *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8080
   17  1339 RETURN     0    --  *      *       0.0.0.0/0            0.0.0.0/0          

Ideas greatly appreciated.

 

_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue