zlacker

>>todsac+(OP)
Docker has a known security issue with port exposure in that it punches holes through the firewall without asking your permission, see https://github.com/moby/moby/issues/4737

I usually expose ports like `127.0.0.1:1234:1234` instead of `1234:1234`. As far as I understand, it still punches holes this way but to access the container, an attacker would need to get a packet routed to the host with a spoofed IP SRC set to `127.0.0.1`. All other solutions that are better seem to be much more involved.

>>smarx0+P4
The ports thing is what convinced me to transition to Podman. I don't need a container tool doing ports on my behalf.

Why am I running containers as a user that needs to access the Docker socket anyway?

Also, shoutout to the teams that suggest easy setup running their software in a container by adding the Docker socket into its file system.