UFW + Docker incompatibility and secutity risks #3
Description
I just wanted to point out that UFW and Docker don't get along.
It implies Docker opening ports that were initially closed by UFW, thus putting the VPS at risk.
From the official Docker documentation:
If you use ufw or firewalld to manage firewall settings, be aware that when you expose container ports using Docker, these ports bypass your firewall rules. For more information, refer to Docker and ufw.
Two workarounds I found are:
- to read recommendations from: https://github.com/chaifeng/ufw-docker
- do not use default address binding when mapping ports, but instead specify the loopback address, to keep it only available to the local network of the VPS (e.g.,
- "127.0.0.1:5432:5432")