I was recently shocked to find out that docker writes its own iptables rules and ignores ufw bindings completely. I had blocked all ports using the
ufw deny incoming command and then selectively allowed only the ports that I wanted to expose.
I have a very simple setup that utilizes a postgresql container and a simple nodejs application. My primary goal is to keep the postgresql container port off the internet but let the node backend accept requests through port 3333. How do I do that?
docker-compose.yml file looks like this:
version: "3" services: redis: image: redis:latest ports: - 6379:6379 command: ["redis-server", "/redis.conf"] network_mode: host database: image: "postgres" env_file: - ./database/database.env volumes: - database-data:/var/lib/postgresql/data - ./database/init-db.sql:/docker-entrypoint-initdb.d/init.sql ports: - 5432:5432 restart: always network_mode: host backend: depends_on: [database] build: ./server volumes: - ./files:/var/lib/files ports: - 3333:3333 restart: always network_mode: host volumes: database-data: