Hi,
I'm using docker on fedora38 and can't figure out how to prevent port 8080
from being available to the outside world. I've done quite a bit of reading
on this, and it appears I'm not the only one having trouble figuring this
out. This docker doc appears to indicate it shouldn't be listening on the
external port when the -p option is not used.
https://docs.docker.com/network/#the-world
Here's the output from the commands related to docker:
$ ps ax|grep docker
748 ? Ssl 0:01 /usr/bin/dockerd --host=fd:// --exec-opt
native.cgroupdriver=systemd --selinux-enabled --log-driver=journald
--live-restore --default-ulimit nofile=1024:1024 --init-path
/usr/libexec/docker/docker-init --userland-proxy-path
/usr/libexec/docker/docker-proxy
882 ? Ssl 0:00 containerd --config
/var/run/docker/containerd/containerd.toml
2785 ? Sl 0:00 /usr/libexec/docker/docker-proxy -proto tcp
-host-ip 0.0.0.0 -host-port 8080 -container-ip 172.29.0.2 -container-port
1080
2791 ? Sl 0:00 /usr/libexec/docker/docker-proxy -proto tcp
-host-ip :: -host-port 8080 -container-ip 172.29.0.2 -container-port 1080
2807 ? Sl 0:00 /usr/libexec/docker/docker-proxy -proto tcp
-host-ip 0.0.0.0 -host-port 8025 -container-ip 172.29.0.2 -container-port
1025
2814 ? Sl 0:00 /usr/libexec/docker/docker-proxy -proto tcp
-host-ip :: -host-port 8025 -container-ip 172.29.0.2 -container-port 1025
2829 ? Sl 0:00 /usr/bin/containerd-shim-runc-v2 -namespace
moby -id c0de8bf0f713d568adcbb323ab3114b20e374cb32b0841e054fb5e24d48b4416
-address /var/run/docker/containerd/containerd.sock
I've tried creating an explicit rule that restricts access to port 8080 on
all interfaces except for localhost, but scanning that port externally
still shows it's available.
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source
destination
0 0 DROP 6 -- enp1s0 * 0.0.0.0/0
0.0.0.0/0 tcp dpt:8080
0 0 DROP 6 -- br-a6d9c4747d4e * 0.0.0.0/0
0.0.0.0/0 tcp dpt:8080
17 1339 RETURN 0 -- * * 0.0.0.0/0
0.0.0.0/0
Ideas greatly appreciated.