this post was submitted on 28 Oct 2023
5 points (100.0% liked)

Self-Hosted Main

502 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
communick@selfhosted.forum
5
Can somebody help me understand the 0.0.0.0 address in docker? (alien.top)
submitted 10 months ago by Rafa130397@alien.top to c/main@selfhosted.forum
5 comments fedilink hide all child comments
 

Basically, I have this doubt, I have some self hosted services in docker where I add the ports like this:
host_port:container_port, so I don't specify the interface, so by default, it is 0.0.0.0.

Somebody recently told me that this is dangerous and that I expose my services to the public internet by doing this. I don't want to do that since I am the only one accessing them so I just use a vpn to access them. So, to try this out, I typed in my browser my public ip alongside the host port I used for one of my services but I cannot access it. This has me puzzled. How's the deal? Am I exposing it? Should I change it?

What are your thoughts? Thanks!

you are viewing a single comment's thread
view the rest of the comments
[–] NikStalwart@alien.top 2 points 10 months ago (1 children)

A few things, in no particular order:

  • Docker interferes with user-defined firewall rules on the host. You need to expend a lot of effort to make your rules persist above docker. This functionally means that, if you are running a public-facing VPS/dedicated server and bind services to 0.0.0.0, even if you set up a firewall on the same machine, it won't work and your services will be publicly accessible
  • If you have access to a second firewall device  —  whether it is your router at home, or your hosting provider's firewall (Hetzner, OVH both like to provide firewall controls external to your server)  — this is not the biggest concern.
  • There is no reason to bind your containers to 0.0.0.0. You will usually access most of your containers from a certain IP address, so just bind them to that IP address. My preference is to bind to any address in the 127.0.0.0/8 subnet (yes, that entire subnet is loopback) and then use a reverse proxy. Alternatively, look into the 'macvlan' and 'ipvlan' docker network drivers.

Good luck

[–] Rafa130397@alien.top 1 points 10 months ago

Hey! Thanks a lot for your reply! I just have two other questions. First of all, the address is regarding the host right? And that ip should be the static ip of the computer or the 127…?And also, is there a way to put that same ip for all services in the docker compose file or I have to do it for everyone manually? Thanks again!