Exposing dockers to Internet?

[Megaman69]

So I have all the usual plex stuff, Radarr, Ombi, etc. I use caddy for reverse proxy so I can access them from anywhere. These are all on a windows machine and now I'm moving everything to my new unraid server. I moved my web server to an Ubuntu machine because I was under the impression that it was a bad idea to expose your unraid machine to the internet. My question is should i install all these apps on the Ubuntu machine for security purposes? Or because these are running in docker its safe to reverse proxy to them? Its not really any harder either way, just not sure about the best security.

 

Thanks

[Hoopster]

4 minutes ago, Megaman69 said:

My question is should i install all these apps on the Ubuntu machine for security purposes? Or because these are running in docker its safe to reverse proxy to them?

You should not directly expose your unRAID server to the internet by opening common ports such as SSH, HTTP, etc. to the outside world; however, port forwarding specific docker ports does not expose the server in the same way and is generally considered "safe" (depending on how security conscious you are).

 

There are many, many unRAID users who are using reverse proxy to docker containers and/or accessing the unRAID server remotely via OpenVPN or the new WireGuard implementation built into the 6.8.x release candidates.

[golli53]

Security measures like fail2ban are much easier to set up on Ubuntu than unRAID (to prevent brute force attacks into password-protected services). Otherwise, there's no difference as long as you only expose the port for the specific service.