You’re probably already aware of this, but if you run Docker on linux and use ufw or firewalld - it will bypass all your firewall rules. It doesn’t matter what your defaults are or how strict you are about opening ports; Docker has free reign to send and receive from the host as it pleases.
If you are good at manipulating iptables there is a way around this, but it also affects outgoing traffic and could interfere with the bridge. Unless you’re a pointy head with a fetish for iptables this will be a world of pain, so isn’t really a solution.
There is a tool called ufw-docker that mitigates this by manipulating iptables for you. I was happy with this as a solution and it used to work well on my rig, but for some unknown reason its no-longer working and Docker is back to doing its own thing.
Am I missing an obvious solution here?
It seems odd for a popular tool like Docker - that is also used by enterprise - not to have a pain-free way around this.
Which is weird for you to say since practically all of the issues you list are mistakes that amateurs and hobbyists make.
this is selfhosted. a community that’s predominantly amateur or hobbyist.
But absolutely none of the issues you listed are issues with iptables.
I wouldn’t go onto a teen community and spout off how to make explosives even though they’re relatively safe to a trained individual.
same reason behind not allowing a hobbyist and amateur community to think that iptables and firewalld is the best/only solution.
it’s dangerous and someone will get hurt eventually.
This is… Pretty stupid. There are things to be careful about but it’s pretty straight forward to use iptables.