1.8 KiB
Architecture Decision Records
ADR-1: Docker's published ports are filtered in DOCKER-USER by the package
Status: Accepted
Context: Docker adds its own iptables rules for published ports. They are evaluated before
UFW's, so a published port is reachable from the external interface whatever UFW says. Docker
reserves the DOCKER-USER chain, evaluated first in FORWARD, for rules of the operator. The
router is an internet-facing host, and Docker is installed on it for services run alongside the
router.
Decision: The package secures Docker itself. A docker configuration section has mode
(auto, on, off) and exposed_ports. In auto mode the rules are applied when
docker.service is installed, which is what the package looks up; on requires Docker and
off removes the rules. The rules are in a chain of their own, VPN-ROUTER-DOCKER, entered by
one jump at the top of DOCKER-USER. For traffic from the external interface they accept IPsec
protected traffic, TCP to exposed_ports and established connections, and drop the rest. The
vpn-router-docker unit applies them after docker.service starts and removes them when it
stops; vpn-router-setup restarts it while Docker runs.
Consequences: Installing Docker first is recommended; auto mode then finds it as soon as the
package is configured. When Docker is installed after the package, the rules are applied by
restarting vpn-router-setup, a reboot or a restart of Docker, not by Docker's first start,
because vpn-router-docker is already active. A published
port is reachable from the external interface only when it is in exposed_ports. Other rules
in DOCKER-USER are not touched, because the package owns only its own chain. Restarting Docker
restores the rules. The rules cover IPv4 only.