Why is this docker image allowed behind a firewall?

Question

I am launching a docker container that binds the port 9000:9000to the host, but ufw is also enabled. The only valid ports are 22, 80, 443.

So why can I connect to this container using the host IP? Should I block the 9000port ufw?

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
14417c4f71fb dockerui / dockerui "/ dockerui" 2 seconds ago Up 2 seconds 0.0.0.0:9000->9000/tcp docker_ui

root @ docker : ~ # ufw status
Status: active

To action from
- ------ ----
22 ALLOW Anywhere
80 ALLOW Anywhere
443 ALLOW Anywhere
22 (v6) ALLOW Anywhere (v6)
80 (v6) ALLOW Anywhere (v6)
443 (v6) ALLOW Anywhere (v6)

Are all ports blocked by default when ufw is turned on?

Answer 1

Docker silently modifies iptables. You can start the Docker daemon with the option --iptables=falseby editing DOCKER_OPTSin / etc / default / docker

Answer 2

Docker is cheating iptables, and UFW is not aware of this.

, : fooobar.com/questions/826223/...

, .

Answer 3

adding "--iptables = false" is not a good solution, as I said here fooobar.com/questions/15414154 / ...

The best solution is to add these lines to /etc/ufw/after.rules.

# BEGIN UFW AND DOCKER
*filter
:ufw-user-forward - [0:0]
:DOCKER-USER - [0:0]
-A DOCKER-USER -j RETURN -s 10.0.0.0/8
-A DOCKER-USER -j RETURN -s 172.16.0.0/12
-A DOCKER-USER -j RETURN -s 192.168.0.0/16

-A DOCKER-USER -p udp -m udp --sport 53 --dport 1024:65535 -j RETURN

-A DOCKER-USER -j ufw-user-forward

-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 192.168.0.0/16
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 10.0.0.0/8
-A DOCKER-USER -j DROP -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -d 172.16.0.0/12
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 192.168.0.0/16
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 10.0.0.0/8
-A DOCKER-USER -j DROP -p udp -m udp --dport 0:32767 -d 172.16.0.0/12

-A DOCKER-USER -j RETURN
COMMIT
# END UFW AND DOCKER