Explicitly binding certain ports to the container has a similar effect, no?

My problem with podman is the incompatibility with portainer :(

Any recommendations?

This is the way.

network: host gives the container basically full access to any port it wants. But even with other network modes you need to be careful, as any -p <external port>:<container port> creates the appropriate firewall rule automatically.

Actually I believe host networking would be the one case where this isn't an issue. Docker isn't adding iptables rules to do NAT masquerading because there is no IP forwarding being done.

When you tell docker to expose a port you can tell it to bind to loopback and this isn't an issue.

eh, booting into single user mod should work fine, uninstall podman and init 5

How though? A database in Docker generally doesn't need any exposed ports, which means no ports open in UFW either.

Counterpoint

Do you mean a hardware firewall?

have a dedicated firewall

I mean, don’t router firewalls count in this regard? Isn’t that kinda part of their job?

To be fair, the largest problem here is that it presents itself as the kind of isolation that would respect firewall rules, not that they don't respect them.

People wouldn't make the same mistake in NixOS, despite it doing exactly the same.

This is why I hate Docker.

I don’t know how much hackery and fuckery there is with docker specifically. The majority of what docker does was already present in the Linux kernel namespaces, cgroups etc. Docker just made it easier to build and ship the isolated environments between systems.

Try podman and quadlets

ufw just manages iptables rules, if docker overrides those it's on them IMO

Docker spesifically creates rules for itself which are by default open to everyone. UFW (and underlying eftables/iptables) just does as it's told by the system root (via docker). I can't really blame the system when it does what it's told to do and it's been administrators job to manage that in a reasonable way since forever.

And (not related to linux or docker in any way) there's still big commercial software which highly paid consultants install and the very first thing they do is to turn the firewall off....

I also ended up using firewalld and it mostly worked, although I first had to change some zone configs.

My impression from a recent crash course on Docker is that it got popular because it allows script kiddies to spin up services very fast without knowing how they work.

That's only a side effect. It mainly got popular because it is very easy for developers to ship a single image that just works instead of packaging for various different operating systems with users reporting issues that cannot be reproduced.

I dont really understand the problem with that?

Everyone is a script kiddy outside of their specific domain.

I may know loads about python but nothing about database management or proxies or Linux. If docker can abstract a lot of the complexities away and present a unified way you configure and manage them, where's the bad?

That is definitely one of the crowds but there are also people like me that just are sick and tired of dealing with python, node, ruby depends. The install process for services has only continued to become increasingly more convoluted over the years. And then you show me an option where I can literally just slap down a compose.yml and hit "docker compose up - d" and be done? Fuck yeah I'm using that

No it's popular because it allows people/companies to run things without needing to deal with updates and dependencies manually

Another take: Why should I care about dependency hell if I can just spin up the same service on the same machine without needing an additional VM and with minimal configuration changes.

That caused issues with Docker containers being unable to communicate with eachother for me.