Hacker News Reader

I learned this a few months ago too. It's such a weird, stupid system. But everyone seems to think this is pretty normal.

I think the firewall is my business, and nothing else should automatically open ports in it. Especially not docker.

View on HN

Yep, learned that the hard way when it trashed my server UFW config as well. It felt kinda wierd to have a tool change machine configuration in such a way (even VMs generally don't do that?), but what do I know, I still prefer to deploy single binary services.

This is not about being unnormal, this is a design decision. Just because people use docker in the "tradional admin way", too doesn't mean it's a wrong decision to do this. Wishful thinking about what a command of a software does without looking it up is generally dangerous. There are abstractions to help people that don't want to bother, e.g. portainer.

Violates least surprise.

Accomplishes least resistance.

Least resistance is of no legitimate value by itself. It's a goal only within the bounds of other constraints. The examples are literally countless.

Reply on news.ycombinator.com