Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

you are viewing a single comment's thread
view the rest of the comments

[–] peoplebeproblems@midwest.social 0 points 5 days ago (2 children)

Ok, see the sandboxing makes sense and for a language like C++ makes sense. But every other language I used it with is already portable to every OS I have access to, so it feels like that defeats the benefit of using a language that's portable.

[–] hitmyspot@aussie.zone 7 points 5 days ago

I think it's less about making it portable to different OS, and more different versions of the same os on different machines with different configuration and libraries and software versions.

[–] WhyJiffie@sh.itjust.works 3 points 5 days ago (1 children)

it does not solve portability across OS families. you can't run a windows based docker image on linux, and running a linux image on windows is solved by starting a linux VM.

[–] peoplebeproblems@midwest.social 2 points 5 days ago

Oh, fair. That's a good point.