chaifeng/ufw-docker
View on GitHub ↗ ★ 6,846 Shell
To fix the Docker and UFW security flaw without disabling iptables
17 mentions on Hacker News by 17 people: 2 stories, 15 comments · first 2020-09-09 · latest 2026-05-05
20082026
-
I use UFW, and this config: github.com/chaifeng/ufw-docker The only modification is that I pin containers to an IPv4 address so I can limit the forward rule to that address.
comment by przemub · 2026-05-05 · in Should I run plain Docker Compose in production in 2026? -
You might be interested in ufw-docker: https://github.com/chaifeng/ufw-docker
comment by Ey7NFZ3P0nzAe · 2025-12-18 · in I got hacked: My Hetzner server started mining Monero -
…As far as I can tell, it does its job correctly. Is there another problem I am not aware of? [1] https://github.com/chaifeng/ufw-docker
comment by smnc · 2025-06-04 · in Ask HN: Startup getting spammed with PayPal disputes, what should we do? -
…ended up using UFW-Docker. It was fairly straightforward to incorporate into my startup scripts. https://github.com/chaifeng/ufw-docker
comment by bshipp · 2024-01-02 · in Fail2ban Sucks (2020) -
[2016] A solution is known and detailed here: https://github.com/chaifeng/ufw-docker
comment by forbiddenlake · 2023-08-16 · in Docker Overrules UFW -
This helps https://github.com/chaifeng/ufw-docker
comment by alexey-salmin · 2023-07-27 · in DHCP is not blocked by ufw/iptables -
…does add iptables rules by default, which bypass other rules such as those you might set with ufw. https://github.com/chaifeng/ufw-docker has a good overview and ufw-specific solution (I use it on my rpi).
comment by bananadonkey · 2023-01-22 · in Vikunja – Open-source, self-hostable to-do app -
see https://github.com/chaifeng/ufw-docker
comment by ancieque · 2022-07-18 · in Docker Swarm Lowers the Shields -
…behavior is unintutivie but makes sense given how container networking works. If you use UFW read https://github.com/chaifeng/ufw-docker and follow the guide. Then configuring firewall rules to containers is as easy as - name: Open HTTPS…
comment by Spivak · 2022-06-22 · in Permissive forwarding rule leads to unintentional exposure of containers (2021) -
…non standard behavior, but the way the docker team simply washes their hands is incredible. https://github.com/chaifeng/ufw-docker/issues/31 https://news.ycombinator.com/item?id=22299693
comment by figassis · 2021-06-29 · in A Docker footgun led to a vandal deleting NewsBlur's MongoDB database -
…providers like AWS, Hetzner etc all provide the feature to add firewall rules via their UI. [1] https://github.com/chaifeng/ufw-docker
comment by scottydelta · 2021-06-29 · in A Docker footgun led to a vandal deleting NewsBlur's MongoDB database -
Here's the fix to prevent docker messing with ufw rules: https://github.com/chaifeng/ufw-docker
comment by EnigmaCurry · 2021-06-24 · in Hacker deleted all of NewsBlur’s Mongo data and is now holding the data hostage -
…iptables manipulations or use ufw-docker as the author. More about that at ufw-docker documentation https://github.com/chaifeng/ufw-docker
comment by bobuk · 2021-04-25 · in Heroku-style deployments with Docker and Git tags -
For UFW users, installing this will make docker compatible with the firewall. https://github.com/chaifeng/ufw-docker
comment by CGamesPlay · 2020-10-15 · in Dockerfile Security Best Practices -
…dns resolver that is accessible to the outside, as Docker by default bypasses the firewall, see https://github.com/chaifeng/ufw-docker . I'm not quite sure about that, though, so I'd be happy to be corrected and learn more about how your…
comment by matrixagent · 2020-09-09 · in WireHole: Set up Pihole, WireGuard, and Unbound instantly