netfilter privileged: true

roelofz

Hi,

I was researching my docker settings, looking for possible unwanted requests to my system and noticed this setting in docker-compose.yml.

Why is this needed?
Since the docker compose to my knowledge can be altered by an update (I have a lot of modifications strictly kept in the override file), I don’t want to change this myself, but prefer this altered when possible.

Thanks for your explanation.

ETNyx

Hello,

my guess is that, if you change netfilter privileged: true to false MC’s included fail2ban will stop work, so you are trying to disable it?

What unwanted request you are solving?

roelofz

Hi,

This setting allows the container to have unlimited access to hardware resources of the host (maybe more, see disclaimer).
I discovered this when limiting access to a GPU, reason power savings, but this is bigger:
If the container gets compromised, in my example it is possible to abuse the GPU (mining for instance) while this access is not needed.
Privileged: true can be changed to specifically the parts really needed, leaving a safer environment.

Disclaimer: I am not very deep in containerization and security, I tripped over this setting while reducing power usage in my system, not even blaming this container, but noticing this container has this access and therefore potentially this risk.

ETNyx

Oh, I see now. For sure, you are right. This depend on you. I personally would not change this, you are adding one little thing to forgot to check when you update your MC if this broke something.

Personally I do not rely on Docker isolation, I run MC separate in virtualization as isolation and keep MC sole SW in this isolation. This way you do not need to worry for interfering whit rest of your system too much (for example no GPU exposed to mining).

roelofz

I know security versus power efficiency, you are right. It is more secure running isolated, but also more resource hungry. And again, if the design is more secure less can go wrong.
Too much access is never a good thing, so I hope this will get fixed in a later release.

ETNyx

roelofz so I hope this will get fixed in a later release.

for this, check git issues if someone ask for this, if not make an issue. Other than that i do not think it will be even consider,…

roelofz

Hadn’t searched git:
mailcow/mailcow-dockerized7048

So I was not the only one…