Post #2431260
2026-01-14 03:49 UTC
Yep, fair. Those docker-composes which just forward the ports to the host on all interfaces should burn. At least they should make them 127.0.0.1 forwards, I agree.
Replies (1)
-
@kumi@feddit.online 2026-01-14 09:02
I’m guilty of a few of these and sorry not sorry but this is not changing. Often these are written with local dev and testing in mind, and in any case the expectation is that self-hosters will look through them and probably customize them - and in any case be responsble for their own firewalls and proxies - before deploying them to a public-facing server. Larger deployments sometimes have internal load balancers on separate machines so even when reflecting a production deployment, exposing on 0.0.0.0 or running eith network=host might be normal. Never just run third-party compose files for user services on a machine directly exposed to untrusted networks like the internet.