Hacker News Reader

Routable != routed.

If your containers have a Global Unicast Address then it's possible to look at connetion logs and figure out which container made a particular request, for instance.

View on HN

Yes, not addressable is even safer. Especially so for someone not specialized in networking.

It's not safer: it impedes observability.

It doesn't impeed observability for goodness sakes. It does however impeed accidentally opening up your internal network because you don't really understand your firewall/virtual router/whatever.

Of course it impedes observability. With IPv6, I can see the IP addresses of the containers that connect to a service. With IPv4, I get (at best) the IP address of the container host, thanks to NAT.

Are you also afraid of port forwarding? Have you considered that your ISP could choose to send your router packets destined for RFC1918 addresses?

Yes I see the value there. I'm not sure I'm ready to take the risk, and most of the traffic is IPv4 anyway, but that's a good point.

Reply on news.ycombinator.com