Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

you are viewing a single comment's thread
view the rest of the comments

[–] peoplebeproblems@midwest.social 5 points 3 months ago (14 children)

So, confession time.

I don't understand docker at all. Everyone at work says "but it makes things so easy." But it doesnt make things easy. It puts everything in a box, executes things in a box, and you have to pull other images to use in your images, and it's all spaghetti in the end anyway.

If I can build an Angular app the same on my Linux machine and my windows PC, and everything works identically on either, and The only thing I really have to make sure of is that the deployment environment has node and the angular CLI installed, how is that not simpler than everything you need to do to set up a goddamn container?

[–] Lightfire228@pawb.social 4 points 3 months ago* (last edited 3 months ago)

Think of it more like pre-canned build scripts. I can just write a script (DockerFile), which tells docker how to prepare the environment for my app. Usually, this is just pulling the pre-canned image for the app, maybe with some extra dependencies pulled in.

This builds an image (a non-running snapshot of your environment), which can be used to run a container (the actual running app)

Then, i can write a config file (docker-compose.yaml) which tells docker how to configure everything about how the container talks to the host.

shared folders (volumes)
other containers it needs to talk to
network isolation and exposed ports

The benefit of this, is that I don't have to configure the host in any way to build / host the app (other than installing docker). Just push the project files and docker files, and docker takes care of everything else

This makes for a more reliable and dependable deploy

You can even develop the app locally without having any of the devtools installed on the host

As well, this makes your app platform agnostic. As long as it has docker, you don't need to touch your build scripts to deploy to a new host, regardless of OS

A second benefit is process isolation. Should your app rely on an insecure library, or should your app get compromised, you have a buffer between the compromised process and the host (like a light weight VM)

load more comments (13 replies)