[dmurray]

Yeah, it's bad for the industry right now, but this is just a transition period! Once we get through the pain of losing a few databases, the new steady state where nobody's data is stored in world-writable databases will be better for everyone, and that will be worth the cost.

Consider if this happened five years ago, it would have had a smaller cost than happening today. And it was probably going to happen at some point, so better that it happened five years ago than today. By the same argument, better that it happened now than at any point in the future.

I'm not sure how serious I am about this argument but...at least a little bit? I guess the alternative argument is that any day now software vendors would have all moved to secure-by-default platforms where deploying a world-writable Redis in production would have been so difficult that it rarely happened.

[1337shadow]

If you have Docker then make sure you have a firewall on top of it, otherwise it will expose pretty much what any docker user wants !

[BrandoElFollito]

What do you mean by that?

[Sebb767]

Docker uses it's own iptables rules which have priority over the system ones. Therefore, even if you have an iptables-based firewall blocking all ports, a docker service will still be reachable, unless configured not to be in docker itself.

[BrandoElFollito]

I do not understand what you mean by "priority over the system ones"

A docker container can have internal ports exposed explicitly, or use host networking. In any case these are ports exposed by the docker-proxy executable - an executable like any other on the system.

Then come the iptables rules of the system (which open or not data flow to the ports exposed by docker-proxy).

Or is it different?

[BrandoElFollito]

Ah, now I get what you mean - that entries such as

    ACCEPT     tcp  --  anywhere             172.19.0.10          tcp dpt:8843

are created by docker, independently from the configuration of iptables themselves.

[Sebb767]

Taking precedence was not the ideal word - it uses the same ip tables, but it inserts its own table as the first one. Therefore it 'ignores' system rules, which might come at a surprise.