for-linux

> v29.0 will have support for nftables. It'll be marked as experimental in the first few releases to allow us to change anything without worrying about backward compatibility. It would've been nice to at least link to the EPIC[1] to provide some kind of evidence that it is actually been worked on. Sorry to be a bit snarky, but this has been a known issue for 9 years now[2,3,4] with no development despite claims to the contrary by Docker Inc (Mirantis now, I guess?). Out of interest, is this being merged with libnetwork or is being implemented separately (a quick look gave me the impression it was being implemented separately but libnetwork was re-merged to Docker a while ago). Also I guess your comment in [5] is outdated and it will actually be in v29? [1]: https://github.com/moby/moby/issues/49634 [2]: https://github.com/moby/libnetwork/

Reading the GitHub issue about this is somewhat entertaining: https://github.com/docker/for-linux/issues/690 People are getting hacked a lot because of this, and docker doesn't seem to care all that much.

There have been issues[1] with seccomp. Maybe try with seccomp disabled for that container? --security-opt seccomp:unconfined More info here[2]. [1]: https://github.com/docker/for-linux/issues/738 [2]: http://mamememo.blogspot.com/2020/05/cpu-intensive-rubypytho...

According to comparitech[1] it is Yet Another Elastic database exposed. I do wonder a bit how the people at Elastic continues to defend not having authentication enforced by default. As of today, going to https://www.elastic.co/guide/en/elasticsearch/reference/curr... and following their guide for a self hosted ES instance is probably the fastest way to have a data breach. Especially if you had a firewall like ufw in place and relied on it to not expose everything (because of dockers continued insistence on bypassing it [2]). [1] https://www.comparitech.com/blog/information-security/thai-t... [2] https://github.com/docker/for-linux/issues/690

link for the missing DOCKER-USER chain: https://github.com/docker/for-linux/issues/810 - so if you are unlucky you are one apt upgrade away from data theft...

It's also easy to get bitten by Docker. You can secure your server with iptables/ufw only to discover that docker happily punches through your firewall and you need to filter on the DOCKER-USER chain - and even that was broken: https://unrouted.io/2017/08/15/docker-firewall/ https://github.com/docker/for-linux/issues/690

I'm assuming a lot here, but I believe many recent data breaches are due to some company leaving their servers wide open. I'm assuming a lot here, but its reasonable that most deployments today are containerized, and if not Kubernetes, they're usually docker. Are most developers aware that "ufw default deny incoming" does not work unless using host networking, or unless we modify the docker daemon or IP tables directly? Also, with the simplicity of ufw, do folks take the time to learn how to work with ip tables? I was bitten by this twice when hosting small dev stuff like mongodb, redis and nfs - often accessed in trusted networks without authentication - where after locking down ufw I'd get a notice from the cloud provider (DO, Hetzner) a few days later telling me which port I had open. After debugging and ending up here (https://github.

To give more background, it supports Podman[1], which behaves the same as Docker in many ways. But the support situation changed with Fedora 31 because of CgroupsV2[2]; however, that doesn't mean Docker CE _won't_ ever run on Fedora 31. Follow this GitHub issue[3] for progress [1] https://podman.io [2] https://fedoraproject.org/wiki/Changes/CGroupsV2 [3] https://github.com/docker/for-linux/issues/665

Docker has not built support for cgroups v2 - which has been available in linux for 3 years. https://github.com/opencontainers/runc/issues/654 in order to force this issue, Fedora has made cgroups v2 as default and mandatory in the new upcoming Fedora 31 causing docker to fail to run. https://github.com/docker/for-linux/issues/665 Podman (and other docker equivalents) have supported cgroups v2 for years. I suspect that k8s will move away from docker to recommending one of the alternatives pretty soon.

Is it anything to do with this issue, where Docker is waking the cpu from sleep too often? https://github.com/docker/for-linux/issues/382

The new package in Ubuntu Trusty seems to be broken. Not that Trusty is supported for much longer. See https://github.com/docker/for-linux/issues/591