[deleted]

Comments

• f314@lemmy.world ⁨17⁩ ⁨hours⁩ ago

  [deleted]

  source

  • magnue@lemmy.world ⁨15⁩ ⁨hours⁩ ago

    It’s obvious, but I can never put my finger on exactly why

    source

    • f314@lemmy.world ⁨15⁩ ⁨hours⁩ ago

      The X that would have Y:

      The X:

      The A is B: Do X instead of Y

      It just loves these stupid patterns. They’re impactful when used sparingly (like a the conclusion to a sectioning article), but it just plasters them all over the place and it just feels weird.

      source

      • -> View More Comments
• ShortN0te@lemmy.ml ⁨17⁩ ⁨hours⁩ ago

  How do you expose the ports? With just 3000:3000 or with a defined IP like 127.0.0.1:3000:30000?

  Docker does for example also circumvent firewalls like ufw when using the first port mapping and basically mapping the ports to every IP.

  source

  • Oth@lemmy.zip ⁨16⁩ ⁨hours⁩ ago

    It’s an AI bot, pure slop, baiting engagement with “see my next post for the actual info”. Just ignore it.

    source
  • lemmyvore@feddit.nl ⁨14⁩ ⁨hours⁩ ago

    It doesn’t “circumvent firewalls”, it’s helping you. You’re asking it to forward a port from the container’s internal interface, through the bridge to the host, and expose it on all interfaces on the host.

    There’s a small set of people who apparently like to do that by hand(?) but the vast majority prefer Docker to write and maintain all those rules… especially since it also takes them up and down as needed when the container goes up or stops, and also updates them with the correct IPs from its internal networks which are allocated semi-randomly.

    (Fair warning, gonna be ranting and shaking my fist for the rest of this comment.)

    I’ve never understood what the problem is, I mean why ask it to expose on all interfaces and then complain it’s actually reachable. And how do these people orchestrate their rules anyway? My bet is they write a manual rule opening port 3000 on one IP then leave it up and forget about it. Meanwhile the port is bleeding into all the host interfaces and ends up being exposed to tunnels and all kinds of things it shouldn’t be. But somehow that’s more secure?

    As a rule of thumb, people really shouldn’t be using network rules unless they’re prepared to describe ALL the device’s networking in every detail. The rules should always start with DENY across the board and open things up explicitly.

    Calling them “firewall” has done a great deal of damage and encouraged people to think it’s somehow secure and ok to have ALLOW on everything then slap DENY on one particular public IP and open some ports on it. If you don’t want to expose a service then the first step would be to not run that service, and the second is to only bind it to the interfaces it really needs to be on. Not opening it up to everything then slapping a “firewall” on top.

    source
• UiUiUiUiUi@piefed.nl ⁨16⁩ ⁨hours⁩ ago

  The trick is to run caddy on the host system no containment, then reverse proxy your wordpress containers through 8080+. Letting fail2ban and crowdsec interact with caddy through docker is too much hassle.

  source
• tribut@infosec.pub ⁨14⁩ ⁨hours⁩ ago

  “The fix is one token”… Sure, because everything is a token now? Are you well?

  source