Can somebody help me understand the 0.0.0.0 address in docker? reddit / selfhosted ---------------------------------------------------------------------- Rafa130397 · 2023-10-28 20:46 Basically, I have this doubt, I have some self hosted services in docker where I add the ports like this: host\_port:container\_port, so I don't specify the interface, so by default, it is [0.0.0.0](https://0.0.0.0). Somebody recently told me that this is dangerous and that I expose my services to the public internet by doing this. I don't want to do that since I am the only one accessing them so I just use a vpn to access them. So, to try this out, I typed in my browser my public ip alongside the host port I used for one of my services but I cannot access it. This has me puzzled. How's the deal? Am I exposing it? Should I change it? What are your thoughts? Thanks! ---------------------------------------------------------------------- prstephens · 2023-10-28 20:58 9nly accessible to the outside world if you've setup port forwarding on your router to that service and port. ---------------------------------------------------------------------- getr00taccess · 2023-10-28 21:26 0.0.0.0 means it binds to every available address on your docker host. If your host has a directly available public IP, then i can understand the concern. if your box is behind your network firewall, then you would have to port forward to have the service reachable from the internet. You’re welcome to bind to a specific IP on your host, I do this over plain 0.0.0.0. Looks cleaner that way IMO. i use static IPs and it’s been fine for me for months-years now. ---------------------------------------------------------------------- Rafa130397 · 2023-10-28 21:34 I don't have a firewall I think, not at least one that I had configured. Sure, then I guess binding to localhost seems reasonable. I have UPnP enabled because it was default in my asus router and because I cannot access my plex server remotely if I turn it off ---------------------------------------------------------------------- getr00taccess · 2023-10-28 21:39 Disable UPnP, it’s not recommended to have it enabled. Simply find the port and ip your plex server is on your network and forward using port forwarding on your Asus router, it will achieve the same effect. ---------------------------------------------------------------------- Rafa130397 · 2023-10-28 21:44 Why is it recommended to turn it off? Also, do I need the public or private ip? I thought port forwarding was discouraged ---------------------------------------------------------------------- getr00taccess · 2023-10-28 21:49 Whoever told you port forwarding is discouraged doesn’t know what they are talking about. Lmao. UPnP and why it’s discouraged: https://arstechnica.com/information- technology/2020/06/upnp-flaw-exposes-millions-of-network-devices-to- attacks-over-the-internet/amp/ Port forward responsibly to only those services that need it. This is standard practice. Best practice is using a reverse proxy and only port forward the reverse proxy. ---------------------------------------------------------------------- ModeratorIsNotHappy · 2023-10-28 22:25 Your router almost certainly has a default firewall with default rules. Typically block all inbound (connections starting from outside the network). Port forwarding will change this to block all but that a specific port which will forward to a specific host ---------------------------------------------------------------------- NikStalwart · 2023-10-28 23:39 That's assuming you're behind a router and not using a cloud VM with no network firewall. In that case....say hello to chinese bot farms. ---------------------------------------------------------------------- getr00taccess · 2023-10-28 23:42 Yep absolutely. Though OP mentions Asus Router so i’m assuming a basic home setup ---------------------------------------------------------------------- NikStalwart · 2023-10-28 23:43 A few things, in no particular order: * Docker interferes with user-defined firewall rules on the host. You need to expend a lot of effort to make your rules persist above docker. This functionally means that, if you are running a public- facing VPS/dedicated server and bind services to 0.0.0.0, even if you set up a firewall on the same machine, it won't work and your services will be publicly accessible * If you have access to a second firewall device  —  whether it is your router at home, or your hosting provider's firewall (Hetzner, OVH both like to provide firewall controls external to your server)  — this is not the biggest concern. * There is no reason to bind your containers to 0.0.0.0. You will usually access most of your containers from a certain IP address, so just bind them to that IP address. My preference is to bind to any address in the 127.0.0.0/8 subnet (yes, that entire subnet is loopback) and then use a reverse proxy. Alternatively, look into the 'macvlan' and 'ipvlan' docker network drivers. Good luck ---------------------------------------------------------------------- Rafa130397 · 2023-10-28 23:51 Hey! Thanks a lot for your reply! I just have two other questions. First of all, the address is regarding the host right? And that ip should be the static ip of the computer or the 127…?And also, is there a way to put that same ip for all services in the docker compose file or I have to do it for everyone manually? Thanks again! ---------------------------------------------------------------------- NikStalwart · 2023-10-28 23:57 I'm a little confused about what you are asking here. I'll answer the simplest question first: > is there a way to put that same ip for all services in the docker compose file or I have to do it for everyone manually? Yes. Look into configuring the docker daemon. There is a json file in /etc/ that you can edit to specify the default bind address for containers. I highly recommend reading the documentation for whatever software you would like to work with. As for the bind address  —  I mean it depends on how you access your container. I run a TURN server in a container. This container binds to the host's external IP because it needs to be externally accessible. However, webapps can go through a reverse proxy like nginx. In that case, it is sufficient to bind the containers to 127.127.127.127, bind nginx to your external IP, and then tell nginx to proxy_pass to 127.127.127.127. ---------------------------------------------------------------------- Rafa130397 · 2023-10-29 00:13 So you are saying that if I change that json file, from now on the containers will not map to 0.0.0.0 but to the ip I set there? Maybe it makes sense to have an env variable and set it on a per container basis. ---------------------------------------------------------------------- [deleted] · 2023-10-29 09:21 [removed] ---------------------------------------------------------------------- lilolalu · 2023-10-29 14:37 You can't bind a docker service to localhost since a container is running on a natted virtual network & ip ---------------------------------------------------------------------- lilolalu · 2023-10-29 16:13 I think you are mixing up a couple of things here. The default network mode is that Docker establishes bridge networks for containers, they run in their own address space and the docker environment creates NAT rules from your computers network to the docker network. The default starting range is 172.16.X.X/16 https://docs.storagemadeeasy.com/appliance/docker_networking#:~:text=T he%20docker%20networking%20starts%20creating,conflict%20with%20already %20established%20networks. If you want your container to use the host IP, you have to use the --network host mode. You can also assign an IP per container, using the macvlan driver. The bind address 0.0.0.0 only means the services inside the container will answer to request, no matter if you are using the default bridge mode, host mode or macvlan.