ufw-docker VS singularity

I am running ubuntu server 22.04 LTS and have fail2ban running on the host. This works great, no issues and IPs get banned for the rules I have in place. I am using UFW and have updated my after.rules for docker based on the recommendations here.

I use this without problems for Long time, https://github.com/chaifeng/ufw-docker

[2016]

A solution is known and formed detailed here: https://github.com/chaifeng/ufw-docker

In any case, maybe try to compare the blocked port ranges with the ports you are using. Did you see this https://github.com/chaifeng/ufw-docker

https://github.com/chaifeng/ufw-docker For example.

ufw is nice, when you are on public networks. And very nice if you are playing with SSH-Server, Docker,.. on your notebook. Couse you write coding, I want to add this, if you use docker.

You can use use this for a more manual approach: https://github.com/chaifeng/ufw-docker

Sorry that's about the extent of my docker network knowledge. One other thing you can check though - are you running ufw on the host? If so you can try updating the config with ufw-docker.

Hi! I'm also new to the homelab category, but I have a bit of experience. I'm currently running Ubuntu 22.04, and the only problem what I had is docker containers not working with ufw. (Fix can be found here: https://github.com/chaifeng/ufw-docker) I've been running my stuff in Docker containers, and it worked pretty well for me. So if you are also new to this, I'd definetly recommend Ubuntu for its simplicity. (Also tons of already great tutorials on how to do literally anything)

rkt (and many other container solutions) was introduced after docker was released and became popular... they even mentioned docker's shortcomings as a motivation for the project creation [0]. It had all the same problems as other replacement software: there were plenty of bugs and missing features, documentation was limited, and there are no community to help you (the announcement explicitly mentions "prototype quality release"). None of those would be fatal if it was significantly better than docker, but it was not -- it was basically the same functionality. So almost no one made the switch. It is closed now [1]

And why "rkt"? There were much better alternative container runtimes. For example Sylabs Singularity [2] -- container-as-a-file, instant mounting, etc... I wish more people knew about it.

[0] https://web.archive.org/web/20141201181834/https://coreos.co...

[1] https://github.com/rkt/rkt#warning-end-of-project-warning

[2] https://github.com/sylabs/singularity#singularityce

Docker (and the current generation of OCI runtimes) is rather shitty at host OS isolation too. It may have started well, but over time more capabilities were added for the convenience of developers and at the cost of maintainers. I would personally love if the ecosystem were to shift to more isolated workloads with better HPC support. Singualrity looks promising but still maintains OCI compatibility.