{"action":"created","issue":{"url":"https://api.github.com/repos/moby/moby/issues/22054","repository_url":"https://api.github.com/repos/moby/moby","labels_url":"https://api.github.com/repos/moby/moby/issues/22054/labels{/name}","comments_url":"https://api.github.com/repos/moby/moby/issues/22054/comments","events_url":"https://api.github.com/repos/moby/moby/issues/22054/events","html_url":"https://github.com/moby/moby/issues/22054","id":148479227,"node_id":"MDU6SXNzdWUxNDg0NzkyMjc=","number":22054,"title":"Docker Network bypasses Firewall, no option to disable","user":{"login":"BenjamenMeyer","id":1074110,"node_id":"MDQ6VXNlcjEwNzQxMTA=","avatar_url":"https://avatars1.githubusercontent.com/u/1074110?v=4","gravatar_id":"","url":"https://api.github.com/users/BenjamenMeyer","html_url":"https://github.com/BenjamenMeyer","followers_url":"https://api.github.com/users/BenjamenMeyer/followers","following_url":"https://api.github.com/users/BenjamenMeyer/following{/other_user}","gists_url":"https://api.github.com/users/BenjamenMeyer/gists{/gist_id}","starred_url":"https://api.github.com/users/BenjamenMeyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/BenjamenMeyer/subscriptions","organizations_url":"https://api.github.com/users/BenjamenMeyer/orgs","repos_url":"https://api.github.com/users/BenjamenMeyer/repos","events_url":"https://api.github.com/users/BenjamenMeyer/events{/privacy}","received_events_url":"https://api.github.com/users/BenjamenMeyer/received_events","type":"User","site_admin":false},"labels":[{"id":237472034,"node_id":"MDU6TGFiZWwyMzc0NzIwMzQ=","url":"https://api.github.com/repos/moby/moby/labels/area/networking","name":"area/networking","color":"fbca04","default":false},{"id":375241376,"node_id":"MDU6TGFiZWwzNzUyNDEzNzY=","url":"https://api.github.com/repos/moby/moby/labels/version/1.10","name":"version/1.10","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":55,"created_at":"2016-04-14T20:52:39Z","updated_at":"2018-06-23T22:31:03Z","closed_at":null,"author_association":"NONE","body":"**Output of `docker version`:**\n\n```\nClient:\n Version:      1.10.3\n API version:  1.22\n Go version:   go1.5.3\n Git commit:   20f81dd\n Built:        Thu Mar 10 15:54:52 2016\n OS/Arch:      linux/amd64\n\nServer:\n Version:      1.10.3\n API version:  1.22\n Go version:   go1.5.3\n Git commit:   20f81dd\n Built:        Thu Mar 10 15:54:52 2016\n OS/Arch:      linux/amd64\n```\n\n**Output of `docker info`:**\n\n```\nContainers: 14\n Running: 5\n Paused: 0\n Stopped: 9\nImages: 152\nServer Version: 1.10.3\nStorage Driver: aufs\n Root Dir: /var/lib/docker/aufs\n Backing Filesystem: extfs\n Dirs: 204\n Dirperm1 Supported: false\nExecution Driver: native-0.2\nLogging Driver: json-file\nPlugins: \n Volume: local\n Network: bridge null host\nKernel Version: 3.13.0-58-generic\nOperating System: Ubuntu 14.04.4 LTS\nOSType: linux\nArchitecture: x86_64\nCPUs: 8\nTotal Memory: 7.793 GiB\nName: brm-pheonix-dev\nID: Y6Z4:6D53:RFOL:Z3CM:P7ZK:H6HL:RLV5:JT73:LZMC:DTBD:7ILK:2RS5\nUsername: benjamenmeyer\nRegistry: https://index.docker.io/v1/\n```\n\n**Additional environment details (AWS, VirtualBox, physical, etc.):**\nRackspace Cloud Server, Ubuntu 14.04, but that shouldn't really matter\n\n**Steps to reproduce the issue:**\n1. Setup the system with a locked down firewall\n2. Create a set of docker containers with exposed ports\n3. Check the firewall; docker will by use \"anywhere\" as the source, thereby all containers are exposed to the public.\n\n**Describe the results you received:**\nroot@brm-pheonix-dev:~/rse# iptables --list DOCKER\nChain DOCKER (1 references)\ntarget     prot opt source               destination  \nACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:6379\n\n**Describe the results you expected:**\nroot@brm-pheonix-dev:~/rse# iptables --list DOCKER\nChain DOCKER (1 references)\ntarget     prot opt source               destination  \nACCEPT     tcp  --  127.0.0.0/24             172.17.0.2           tcp dpt:6379\nACCEPT     tcp  --  172.16.0.0/16             172.17.0.2           tcp dpt:6379\n\n**Additional information you deem important (e.g. issue happens only occasionally):**\n\nBy default docker is munging the firewall in a way that breaks security - it allows all traffic from all network devices to access the exposed ports on containers. Consider a site that has 2 containers: Container A exposes 443 running Nginx, and Container B runs an API on port 8000. It's desirable to open Container A to the public for use, but hide Container B entirely so that it can only talk to localhost (for testing by the user) and the docker network (for talking to Container A). It might also be desirable for testing purposes to have Container C be a database used by Container B with the same kind of restrictions.\n\nI found this because of monitoring logs on a service I had _thought_ was not open to the public. After finding log entries from sources trying to break in, I checked the firewall rules and found there was no limit on the source addresses or interfaces. I use UFW and only allow SSH onto this particular box, and would prefer to keep it that way. This can dramatically impact using Docker containers to deploy services and lead to potential security problems if people are not careful.\n\nThe best security practice would be to by default limit the networking to work like above desired effect example, and then allow the user to add the appropriate firewall, etc rules to override such behavior, or have an option to revert to the current behavior. I know that for legacy reasons that is not likely since it would break a lot of things on up-date; so at least having an option to enable the above that can be turned on now would be a good first step, and perhaps later after much warning make it the default behavior. Assuming the default behavior is secure, having functionality to manage this (firewall->enable public port, ip) in the docker-compose yml would be a great way to visibly make it known what is going on.\n\nI did find the --iptables=false option, however, I don't want to have to be setting all the rules myself. The only thing I am objecting to is the source setting for the rules.\n\nWhile I have not verified it, I suspect all the firewalls supported by docker will have the same issue.\n"},"comment":{"url":"https://api.github.com/repos/moby/moby/issues/comments/399714753","html_url":"https://github.com/moby/moby/issues/22054#issuecomment-399714753","issue_url":"https://api.github.com/repos/moby/moby/issues/22054","id":399714753,"node_id":"MDEyOklzc3VlQ29tbWVudDM5OTcxNDc1Mw==","user":{"login":"publicocean0","id":2518180,"node_id":"MDQ6VXNlcjI1MTgxODA=","avatar_url":"https://avatars1.githubusercontent.com/u/2518180?v=4","gravatar_id":"","url":"https://api.github.com/users/publicocean0","html_url":"https://github.com/publicocean0","followers_url":"https://api.github.com/users/publicocean0/followers","following_url":"https://api.github.com/users/publicocean0/following{/other_user}","gists_url":"https://api.github.com/users/publicocean0/gists{/gist_id}","starred_url":"https://api.github.com/users/publicocean0/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/publicocean0/subscriptions","organizations_url":"https://api.github.com/users/publicocean0/orgs","repos_url":"https://api.github.com/users/publicocean0/repos","events_url":"https://api.github.com/users/publicocean0/events{/privacy}","received_events_url":"https://api.github.com/users/publicocean0/received_events","type":"User","site_admin":false},"created_at":"2018-06-23T22:31:03Z","updated_at":"2018-06-23T22:31:03Z","author_association":"NONE","body":"It seams iptables has strange behaviours if you change iptables when docker is running. If you stop docker set iptables and the restart docker all working as foreseein. My worry is ... if i have to change iptables in production?"}}
{"actor":{"display_login":"publicocean0"}}