Take a look at docker-socket-proxy as a somewhat of a counter to this issue:
replyDo you know about docker compose overwriting your carefully set firewall rules? That’s the other docker thing…
replyGo on, what other docker things should we know?
replyAbsolutely. Docker is a boiling mess of baked-in convenience workarounds (ie vulns). It's an orchestration layer (like k8s with containers), not a real security boundary like VMs. OTOH, single-purpose VMs are basically just as easy these days and those can still pull in containers as needed.
reply