Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

do not expose ports over IPv6 unless published #21614

Open
ibukanov opened this issue Mar 29, 2016 · 5 comments

Comments

@ibukanov
Copy link

commented Mar 29, 2016

Currently with IPv6 in practice port publishing is no-op. With IPv6 it is expected that a container that is exposed to outside world should have globally routable IPv6 address so all its ports are exposed.

This is bad from a security point of view as it makes very easy to accidentally expose a port that should only be open to members of a docker network. Case in point is a password-less database container that is a part of an application that is exposed over IPv6 to Internet. With typical images unless one is careful such DB container can also be exposed to the internet over IPv6.

It would be nice if docker provide a setting so only ports that are explicitly exposed on the command line will be reachable over IPv6 from outside a docker network. Other ports should be blocked by a firewall rule.

@thaJeztah

This comment has been minimized.

Copy link
Member

commented Mar 31, 2016

/cc @mavenugo

@robbertkl

This comment has been minimized.

Copy link

commented May 6, 2016

For this purpose, I've created docker-ipv6nat. You give your containers non-routable addresses and published ports are forwarded to your containers, just like with IPv4. Probably IPv6 NAT won't make it into Docker anytime soon (or at all), so for a solution in the meantime, you could give this a try.

@thaJeztah

This comment has been minimized.

Copy link
Member

commented May 6, 2016

@robbertkl thanks for sharing! 👍

@LK4D4

This comment has been minimized.

Copy link
Contributor

commented Nov 30, 2016

@treysis

This comment has been minimized.

Copy link

commented May 16, 2019

will we see a solution to this eventually?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
6 participants
You can’t perform that action at this time.