Docker and Coolify
How the agent protects servers that publish ports through Docker.
The agent runs on the host, as a systemd service, and also covers ports Docker publishes, like the ones created by Coolify or Compose.
Why it matters
Docker routes traffic for published ports through the FORWARD chain, not INPUT. A tool that only looks at INPUT leaves those ports out.
How atalince covers them
| Docker backend | Coverage |
|---|---|
| iptables (default) | Through the DOCKER-USER chain, since agent 1.0.4. |
| nftables | Through jumps in FORWARD, since agent 1.0.7. |
Blocks, manual rules and geoblocking also apply to those ports.
What doesn’t exist yet
Running the agent itself inside a container (Docker, Swarm or Helm) is not a supported install method yet. Install it on the host.