Host OS exposes Redis to world over port 6379

[gugray]

Thank you for the work creating this Docker wrapper!

I followed the guide to deploy Pixelfed using my own NGINX in the host system as a reverse proxy. All ports are set to deny using ufw except 22, 80 and 443.

Unfortunately when docker exposes ports, it does so by circumventing the firewall. As a result, Redis is exposed directly to the internet via the host system. That is a significant security issue and it may unintentionally expose data or allow access to bad actors.

The line responsible for this is in compose.yaml:

    ports:
      - "${DOCKER_REDIS_HOST_PORT}:6379"

This is an unfortunate behavior by Docker. It can be fixed if instead of this:

ports:
  - "6379:6379"

the port is exposed like this:

ports:
  - "127.0.0.1:6379:6379"

This way other services on the host will have access to it, but it will not be exposed to the internet behind the firewall's back. An even better solution would be to create a Docker network and not expose the port to the host at all.

[jippi]

I plan to rework this in #103 - but you might be able to set DOCKER_REDIS_HOST_PORT to 127.0.0.1:6379 to get the outcome you want :)

[manuviens]

Just found that ufw (firewall) have no effect on docker containers. So, redis and the db are wide open.
I tried this and it works, but the healtcheck of the proxy container do not work anymore, which does not seem to affect pixelfed's operation. EDIT : Bad idea.

EDIT :

[manuviens]

I created this compose.override.yaml which seems to work.

networks:
  internal:
    driver: bridge
  external:
    driver: bridge

services:
  proxy:
    networks:
      - external

  web:
    networks:
      - external
      - internal

  db:
    networks:
      - internal

  redis:
    networks:
      - internal

  worker:
    networks:
      - internal

  cron:
    networks:
      - internal

[jippi]

If y'all could try out #103 and see if it work for y'all that would be great

I think it's feature complete, but lacks testing and feedback