Docker routes container traffic in the nat table, which means that packets are diverted before it reaches the INPUT and OUTPUT chains that ufw uses. Packets are routed before the firewall rules can be applied, effectively ignoring your firewall configuration.

you are viewing a single comment's thread
view the rest of the comments

[–] MangoPenguin@lemmy.blahaj.zone 19 points 6 days ago* (last edited 6 days ago) (1 children)

For local access you can use 127.0.0.1:80:80 and it won't put a hole in your firewall.

Or if your database is access by another docker container, just put them on the same docker network and access via container name, and you don't need any port mapping at all.

[–] grrgyle@slrpnk.net 1 points 5 days ago

Yeah, I know that now lol, but good idea to spell it out. So what Docker does, which is so confusing when you first discover the behaviour, is it will bind your ports automatically to 0.0.0.0 if all you specify is 27017:27017 as you port (without an IP address prefixing). AKA what the meme is about.