Administrators that assign container a static IP can not change PORT with Docker Mappings

[simeononsecurity]

Traditionally, you specify "-p PORT:PORT". Users that specify that the contrainer use a network connection that isn't HOST can not change the port from 8443. This is problematic for multiple reasons. First, 8443 is the HTTPS alternate port, not HTTP. As this is HTTP only traffic, port 80 or 8080 should be used. I understand that multiple docker containers may want to use those ports, but that isn't an excuse. Reguardless if the traffic is put behind a reverse proxy, there needes the be the option for us to change the port the service runs on without having to put it behind an additional proxy.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the issue template!

[aptalca]

8443 is the upstream default port, not something we arbitrarily chose.

Reguardless if the traffic is put behind a reverse proxy, there needes the be the option for us to change the port the service runs on without having to put it behind an additional proxy.
I don't follow this part. When you put it behind a reverse proxy, your proxy service is accessible at 80/443, and it connects to code-server on its port 8443 on the backend. No need to change any ports

[simeononsecurity]

Lets say, idk I'm an crazy homelaber or enterprise who runs an IPS/IDS. Firewalls don't like seeing HTTP traffic on HTTPS ports.
A reverse proxy isn't a solution to a port problem when the port problem can be argueably easily fixed. A reverse proxy only adds security relative to exposing your system unencrypted to the public internet. Traffic between the proxy and the system is still unencrypted. The system is still insecure. You've just added a "secure" gateway to access it publically. It still doesn't make any sense to have HTTP traffic running on 8443.

Not to claim you have security in mind when making the images. But Linux, an already highly secure operating system, and the people who work with it expect things to work certain ways following certain practices. The ones I'm most familiar with being the ISO27xxx series.

I get it from the code maintainer POV, you just don't see it as required. From my POV, why have something work purposely against best practices and what the people using your images expect?

At the very least, it's an issue of principle. At most, it causes many headaches for administrators who want something implemented properly to all best practices.

[aptalca]

Go wild: https://blog.linuxserver.io/2019/09/14/customizing-our-containers/