{"repo":"chaifeng/ufw-docker","free":true,"listed":false,"github":"https://github.com/chaifeng/ufw-docker","clone":"git clone https://github.com/chaifeng/ufw-docker.git","description":"To fix the Docker and UFW security flaw without disabling iptables","language":"Shell","stars":6736,"topics":["docker","ufw","ubuntu","debian","linux","firewall","security","docker-swarm"],"license":"GPL-3.0","category":"deployment-docker-iac","readme_excerpt":"To Fix The Docker and UFW Security Flaw Without Disabling Iptables ================== - English - 中文 TL;DR Please take a look at Solving UFW and Docker issues. Problem UFW is a popular iptables front end on Ubuntu that makes it easy to manage firewall rules. But when Docker is installed, Docker bypass the UFW rules and the published ports can be accessed from outside. The issue is: 1. UFW is enabled on a server that provides external services, and all incoming connections that are not allowed are blocked by default. 2. Run a Docker container on the server and use the -p option to publish ports for that container on all IP addresses. For example: docker run -d --name httpd -p 0.0.0.0:8080:80 httpd:alpine , this command will run an httpd service and publish port 80 of the container to port 8080 of the server. 3. UFW will not block all external requests to visit port 8080. Even the command ufw deny 8080 will not prevent external access to this port. 4. This problem is actually quite serious, which means that a port that was originally intended to provide services internally is exposed to the public network. Searching for \"ufw docker\" on the web can find a lot of discussion: - https://github.com/moby/moby/issues/4737 - https://forums.docker.com/t/running-multiple-docker-containers-with-ufw-and-iptables-false/8953 - https://www.techrepublic.com/article/how-to-fix-the-docker-and-ufw-security-flaw/ - https://blog.viktorpetersson.com/2014/11/03/the-dangers-of-ufw-docker.html - https:","default_branch":null,"files":null,"tree":[],"storefront":"/r/chaifeng","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/chaifeng/ufw-docker/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}