5 ms·
The same thing happened to me a few years ago. I used DigitalOcean's Docker image and it had some message about UFW in motd, so I assumed it works with Docker.
by python273 5y ago
The same thing happened to me a few years ago. I used DigitalOcean's Docker image and it had some message about UFW in motd, so I assumed it works with Docker. So I created a container with passwordless mongodb and it got wiped in a few hours.
And DO still have this in motd for newly created droplets:
Welcome to DigitalOcean's 1-Click Docker Droplet.
To keep this Droplet secure, the UFW firewall is enabled.
All ports are BLOCKED except 22 (SSH), 2375 (Docker) and 2376 (Docker).
Full motd: https://pastebin.com/cdaecHU8 https://pastebin.com/cdaecHU8
Though it links to https://do.co/3j6j3po https://do.co/3j6j3po and it mentions ufw problem:
> Note: The default firewall for the Docker One-Click is UFW, which is a front end to iptables. However, Docker modifies iptables directly to set up communication to and from containers. This means that UFW won’t give you a full picture of the firewall settings. You can override this behavior in Docker by adding --iptables=false to the Docker daemon.
- jbuhbjlnjbn 5y agoSo the makers know of the security issue, but still leave it in by default? That's bad. Either fix the issue, or put warnings all over the place that cannot be missed to inform the user. This is just what another poster commented on, sacrificing security for ease of use.
- python273 5y agoYeah, I reported it to DO support and suggested to add a warning, but seems like it was never added. DigitalOcean Support Thursday, March 15, 2018 9:53 PM Hello, Thank you very much for bringing this to our attention. I will create an internal escalation to our images team to review this. :) [...]