I use nftables to set my firewall rules. I typically manually configure the rules myself. Recently, I just happened to dump the ruleset, and, much to my surprise, my config was gone, and it was replaced with an enourmous amount of extremely cryptic firewall rules. After a quick examination of the rules, I found that it was Docker that had modified them. And after some brief research, I found a number of open issues, just like this one, of people complaining about this behaviour. I think it’s an enourmous security risk to have Docker silently do this by default.
I have heard that Podman doesn’t suffer from this issue, as it is daemonless. If that is true, I will certainly be switching from Docker to Podman.
If you use firewalld, both docker and podman apply rules in a special zone separate from your main one.
That being said, podman is great. Podman in rootful mode, along with podman-docker and docker-compose, is basically a drop-in replacement for Docker.
Is it? Last time I tried none of my docker compose files would start correctly in podman compose.
deleted by creator
podman-compose is different from docker-compose. It runs your containers in rootless mode. This may break certain containers if configured incorrectly. This is why I suggested podman-docker, which allows podman to emulate docker, and the native docker-compose tool. Then you use
sudo docker-composeto run your compose files in rootful mode.How is Podman rootful better than Docker? I was mostly attracted by the rootless path, but the breakage deterred me. Would you be so kind to tell me ?
It isn’t that much better. I use it as drop-in docker replacement. It’s better integrated with things like cockpit though and the idea is that it’s easier to eventually migrate to rootless if you’re already in the podman ecosystem.
Ok that sounds intetesting, I’ve found Cockpit easier to use than Proxmox, I’m new to virtualization and I don’t want do nesting… I fear it will complicate things when I’ll need to do GPU passthrough.
How is Podman integrated into Cockpit?
Also, I had so much trouble trying to bridge my Home Assistant VM to my LAN. Are there any tutorials on how to do this from Cockpit?
Your containers show up in Cockpit under the “Podman containers” section and you can view logs, type commands into their consoles, etc. You can even start up containers, manage images, etc.
Are there any tutorials on how to do this from Cockpit?
I have not done this personally, but I would assume you need to create a bridge device in Network Manager or via Cockpit and then tell your VM to use that. Keep in mind, bridge devices only work over Ethernet.
bridge devices only work over Ethernet
Yes, I want to reach my HA VM from my LAN connected devices.
I’m a podman user, but what’s the point of using podman if you are going to use a daemon and run it as root? I like podman so I can specifically avoid those things.
I am using it as a migration tool tbh. I am trying to get to rootless, but some of the stuff I host just don’t work well in rootless yet, so I use rootful for those containers. Meanwhile, I am using rootless for dev purposes or when testing out new services that I am unsure about.
Podman also has good integration into Cockpit, which is nice for monitoring purposes.
Yeah, it needs those rules for e.g. port-forwarding into the containers.
But it doesnt really ‘nuke’ existing ones.I have simply placed my rules at higher priority than normal. Very simple in nftables and good to not have rules mixed between nftables and iptables in unexpected ways.
You should filter as early as possible anyways to reduce ressource usage on e.g. connection tracking.But it doesnt really ‘nuke’ existing ones.
How come I don’t see my previous rules when I dump the ruleset, then? I have my rules written in
/etc/nftables.conf, and they were previously applied by runningnft -f /etc/nftables.conf. Now, when I dump the current ruleset with# nft list ruleset, those previous rules aren’t there — all I see are Docker’s rules.
It doesn’t nuke your rules. Just ads to them.
How come I don’t see my previous rules when I dump the ruleset, then? I have my rules written in
/etc/nftables.conf, and they were previously applied by runningnft -f /etc/nftables.conf. Now, when I dump the current ruleset with# nft list ruleset, those previous rules aren’t there — all I see are Docker’s rules.You can use a bridge network or the host network.
In bridge network it is like a NAT host. With its own firewall settings.
In host network mode, it will just open the port it needs.
I could be misunderstanding your comment, but you don’t seem to have answered my question of why I don’t see my rules anymore.
This is standard, but often unwanted, behavior of docker.
Docker creates a bunch of chain rules, but IIRC, doesn’t modify actual incoming rules (at least it doesn’t for me) it just will make a chain rule for every internal docker network item to make sure all of the services can contact each other.
Yes it is a security risk, but if you don’t have all ports forwarded, someone would still have to breach your internal network IIRC, so you would have many many more problems than docker.
I think from the dev’s point of view (not that it is right or wrong), this is intended behavior simply because if docker didn’t do this, they would get 1,000 issues opened per day of people saying containers don’t work when they forgot to add a firewall rules for a new container.
Option to disable this behavior would be 100x better then current, but what do I know lol
That assumes you’re on some VPS with a hardware firewall in front.
Often enough you’re on a dedicated server that’s directly exposed to the internet, with those iptables rules being the only thing standing between your services and the internet.
What difference does it make if you open the ports yourself for the services you expose, or Docker does it for you? That’s all that Docker is meant to do, act as convenience so you don’t have to add/remove rules as the containers go up/down, or remember Docker interfaces.
If by any chance you are making services listen on 0.0.0.0 and covering them up with a firewall that’s very bad practice.
There’s no alternative for 0.0.0.0 and a firewall if you’re e.g. using kubernetes.
I’m fairly sure you can find an alternative to whatever problem you’re having.
You need to be able to have multiple nodes in one LAN access ports on each others’ containers without exposing those to the world and without using additional firewalls in front of the nodes.
That’s why kubernetes ended up removing docker support and instead recommends podman or using containerd natively.
Option to disable this behavior would be 100x better then current, but what do I know lol
Prevent docker from manipulating iptables
Don’t know what it’s actually doing, I’m just learning how to work with nftables, but I saved that link in case oneday I want to manage the iptables rules myself :)
Good luck. Your going to have to change the rules whenever the up address of the container changes.
If you are talking about the IP address then just add a static address, no? I do it anyway in my docker compose:
... networks: traefik.net: ipv4_address: 10.10.10.99 networks: traefik.net: name: traefik-net external: trueI’m not an expert so maybe I’m wrong, if so do not hesitate to correct me !
EDIT: If the IP address doesn’t change, you do not need to change to routing and iptables/nftables rules. ??
IIRC, doesn’t modify actual incoming rules (at least it doesn’t for me)
How come I don’t see my previous rules when I dump the ruleset, then? I have my rules written in
/etc/nftables.conf, and they were previously applied by runningnft -f /etc/nftables.conf. Now, when I dump the current ruleset with# nft list ruleset, those previous rules aren’t there — all I see are Docker’s rules.
You can somehow change that behavior: Prevent docker from manipulating iptables
Wow, thanks for the heads up.
Looks like it affects dockerd, but not docker desktop.
Any idea of the docker implementation in Proxmox or TrueNAS? (TrueNAS does containers if I remember right?)
Correct me if I’m wrong, but I don’t think Proxmox uses Docker. I’m pretty sure its containers are LXC containers.
Correct
Oh, yea, you’re right. Thanks
ofcourse docker desktop is not affected because it’s a vm running docker running on your computer. the nftables inside the container are modified by docker
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters HA Home Assistant automation software ~ High Availability HTTP Hypertext Transfer Protocol, the Web IP Internet Protocol LXC Linux Containers NAT Network Address Translation VPS Virtual Private Server (opposed to shared hosting) nginx Popular HTTP server
6 acronyms in this thread; the most compressed thread commented on today has 5 acronyms.
[Thread #589 for this sub, first seen 11th Mar 2024, 10:15] [FAQ] [Full list] [Contact] [Source code]
That’s another good reason to use podman, rules are on nft and separated from your rules.
So better put Docker in a VM so it can’t do any harm to the host?
Lol.
It is enough to put it into its own network namespace.
