Use case
Docker ports are protected too.
Docker forwards published ports through the FORWARD chain. A tool that only looks at INPUT leaves those ports out. atalince covers both.
01The problem
Container traffic doesn't go through INPUT.
When a container publishes a port, as in -p 8080:80, Docker translates the destination and forwards the packet through FORWARD. Rules in INPUT never see it.
The same goes for Compose and Coolify, which publish ports the same way.
02How atalince handles it
Jumps in the right place, no configuration.
- 01 · DOCKER-USER
iptables backend, the default
Since agent 1.0.4, two jumps at the top of DOCKER-USER, only for connections Docker translated on the way in.
- 02 · FORWARD
Docker's nftables backend
Since agent 1.0.7, the same jumps sit at the top of iptables' FORWARD.
- 03 · Rules
Blocks, rules and geoblocking
They apply to published ports too. In rules, the port is the one published on the server: 8080 in the example. Geoblocking is on Pro.
- 04 · Scope
Inbound traffic only
Container egress and traffic between containers don't go through these chains.
03In the firewall
Where the jumps go.
04Limits
What doesn't exist yet.
- The agent runs on the host, as a systemd service. Installing the agent itself inside a container (Docker, Swarm or Helm) isn't supported yet.
Founders program
Use atalince from the start.
Pro features for up to 3 servers, free of charge, for 12 months. Every application is reviewed by the team.