Consider Alternatives to exposing ports to Gerbil in Docker Compose #1692

New Issue

MrUnknownDE · 2026-04-05T19:39:41+02:00

MrUnknownDE commented

2026-04-05 19:39:41 +02:00

Originally created by @bannert1337 on 3/21/2025

Currently, to create a raw TCP/UDP resource the user has to manually expose ports to Gerbil in the Docker Compose.
This is cumbersome and error-prone.

An alternative could be to use network mode host for Gerbil.

Pros of using network mode: host for Gerbil:

Simplified Configuration: Users would no longer need to manually edit the Docker Compose file to expose ports for each raw TCP/UDP resource. This greatly simplifies the initial setup and reduces the burden on the user.
Reduced Error Proneness: Removing the manual port exposure step eliminates the risk of typos, incorrect port mappings, and forgetting to expose necessary ports, leading to a less error-prone configuration process.
More Straightforward User Experience: The setup becomes more intuitive and less technical for users who might not be familiar with Docker networking concepts. The process of adding raw TCP/UDP resources would become smoother and faster.

Cons of using network mode: host for Gerbil:

Security Implications: Running Gerbil in network mode: host significantly reduces network isolation. Gerbil will share the host machine's network namespace, meaning it can bind to any port on the host and could potentially interact with other services running directly on the host. This might be undesirable from a security perspective, especially in shared environments.
Port Conflicts: If Gerbil (or Pangolin functionalities relying on Gerbil) needs to use ports that are already in use by other processes running on the host machine (outside of Docker), port conflicts can occur. This would require manual port management and potentially reconfiguration of existing host services.
Reduced Container Isolation: Using network mode: host goes against the typical best practices of containerization, which emphasize process and network isolation. It makes the container less self-contained and more tightly coupled to the host environment.
Potential for Unexpected Host Network Interactions: Gerbil's unrestricted access to the host network through network mode: host could lead to unexpected interactions or dependencies on the host's network configuration, making the system less portable and predictable across different host environments.

*Originally created by @bannert1337 on 3/21/2025* Currently, to create a raw TCP/UDP resource the user has to manually expose ports to Gerbil in the Docker Compose. This is cumbersome and error-prone. An alternative could be to use network mode `host` for Gerbil. **Pros of using `network mode: host` for Gerbil:** * **Simplified Configuration:** Users would no longer need to manually edit the Docker Compose file to expose ports for each raw TCP/UDP resource. This greatly simplifies the initial setup and reduces the burden on the user. * **Reduced Error Proneness:** Removing the manual port exposure step eliminates the risk of typos, incorrect port mappings, and forgetting to expose necessary ports, leading to a less error-prone configuration process. * **More Straightforward User Experience:** The setup becomes more intuitive and less technical for users who might not be familiar with Docker networking concepts. The process of adding raw TCP/UDP resources would become smoother and faster. **Cons of using `network mode: host` for Gerbil:** * **Security Implications:** Running Gerbil in `network mode: host` significantly reduces network isolation. Gerbil will share the host machine's network namespace, meaning it can bind to any port on the host and could potentially interact with other services running directly on the host. This might be undesirable from a security perspective, especially in shared environments. * **Port Conflicts:** If Gerbil (or Pangolin functionalities relying on Gerbil) needs to use ports that are already in use by other processes running on the host machine (outside of Docker), port conflicts can occur. This would require manual port management and potentially reconfiguration of existing host services. * **Reduced Container Isolation:** Using `network mode: host` goes against the typical best practices of containerization, which emphasize process and network isolation. It makes the container less self-contained and more tightly coupled to the host environment. * **Potential for Unexpected Host Network Interactions:** Gerbil's unrestricted access to the host network through `network mode: host` could lead to unexpected interactions or dependencies on the host's network configuration, making the system less portable and predictable across different host environments.

MrUnknownDE closed this issue

2026-04-05 19:39:41 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1692