{"action":"created","issue":{"url":"https://api.github.com/repos/docker/docker/issues/21614","repository_url":"https://api.github.com/repos/docker/docker","labels_url":"https://api.github.com/repos/docker/docker/issues/21614/labels{/name}","comments_url":"https://api.github.com/repos/docker/docker/issues/21614/comments","events_url":"https://api.github.com/repos/docker/docker/issues/21614/events","html_url":"https://github.com/docker/docker/issues/21614","id":144238901,"number":21614,"title":"do not expose ports over IPv6 unless published","user":{"login":"ibukanov","id":2381216,"avatar_url":"https://avatars.githubusercontent.com/u/2381216?v=3","gravatar_id":"","url":"https://api.github.com/users/ibukanov","html_url":"https://github.com/ibukanov","followers_url":"https://api.github.com/users/ibukanov/followers","following_url":"https://api.github.com/users/ibukanov/following{/other_user}","gists_url":"https://api.github.com/users/ibukanov/gists{/gist_id}","starred_url":"https://api.github.com/users/ibukanov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ibukanov/subscriptions","organizations_url":"https://api.github.com/users/ibukanov/orgs","repos_url":"https://api.github.com/users/ibukanov/repos","events_url":"https://api.github.com/users/ibukanov/events{/privacy}","received_events_url":"https://api.github.com/users/ibukanov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-29T11:50:05Z","updated_at":"2016-03-29T11:50:08Z","closed_at":null,"body":"Currently with IPv6 in practice port publishing is no-op. With IPv6 it is expected that a container that is exposed to outside world should have globally routable IPv6 address so all its ports are exposed.\r\n\r\nThis is bad from a security point of view as it makes very easy to accidentally expose a port that should only be open to members of docker network. Case in point is a password-less database container that is a part of an application that is exposed over IPv6 to Internet. With typical images unless one is careful such DB container can also be exposed to the internet over IPv6.\r\n\r\nIt would be nice if docker provide a setting so only ports that are explicitly exposed on the command line will be reachable over IPv6 from outside a docker network. Other ports should be blocked by a firewall rule."},"comment":{"url":"https://api.github.com/repos/docker/docker/issues/comments/202847424","html_url":"https://github.com/docker/docker/issues/21614#issuecomment-202847424","issue_url":"https://api.github.com/repos/docker/docker/issues/21614","id":202847424,"user":{"login":"GordonTheTurtle","id":10620046,"avatar_url":"https://avatars.githubusercontent.com/u/10620046?v=3","gravatar_id":"","url":"https://api.github.com/users/GordonTheTurtle","html_url":"https://github.com/GordonTheTurtle","followers_url":"https://api.github.com/users/GordonTheTurtle/followers","following_url":"https://api.github.com/users/GordonTheTurtle/following{/other_user}","gists_url":"https://api.github.com/users/GordonTheTurtle/gists{/gist_id}","starred_url":"https://api.github.com/users/GordonTheTurtle/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GordonTheTurtle/subscriptions","organizations_url":"https://api.github.com/users/GordonTheTurtle/orgs","repos_url":"https://api.github.com/users/GordonTheTurtle/repos","events_url":"https://api.github.com/users/GordonTheTurtle/events{/privacy}","received_events_url":"https://api.github.com/users/GordonTheTurtle/received_events","type":"User","site_admin":false},"created_at":"2016-03-29T11:50:07Z","updated_at":"2016-03-29T11:50:07Z","body":"\nIf you are reporting a new issue, make sure that we do not have any duplicates already open. You can ensure this by searching the issue list for this repository. If there is a duplicate, please close your issue and add a comment to the existing issue instead.\n\nIf you suspect your issue is a bug, please edit your issue description to include the BUG REPORT INFORMATION shown below. If you fail to provide this information within 7 days, we cannot debug your issue and will close it. We will, however, reopen it if you later provide the information.\n\nFor more information about reporting issues, see [CONTRIBUTING.md](https://github.com/docker/docker/blob/master/CONTRIBUTING.md#reporting-other-issues).\n\n**You _don't_ have to include this information if this is a _feature request_**\n\n(This is an automated, informational response)\n\n-----------------------------\nBUG REPORT INFORMATION\n-----------------------------\nUse the commands below to provide key information from your environment:\n\n`docker version`:\n`docker info`:\n\nProvide additional environment details (AWS, VirtualBox, physical, etc.):\n\n\n\nList the steps to reproduce the issue:\n1.\n2.\n3.\n\n\nDescribe the results you received:\n\n\nDescribe the results you expected:\n\n\nProvide additional info you think is important:\n\n\n----------END REPORT ---------\n\n\n\n#ENEEDMOREINFO\n"}}