Database ports published to the world
A Compose file publishes ports for five services. Work out which ones listen on every interface, which are bound to localhost only, and why the host firewall does not save you.
Briefing
A cloud provider abuse notice says Redis on your staging VM answered from the internet. The VM runs a Compose stack from /srv/stack.
A ports entry of "6379:6379" binds to 0.0.0.0, every interface. "127.0.0.1:8081:8081" binds only to loopback. Docker inserts its own iptables rules for published ports, so ufw rules do not filter them.
staging-01 · Container audit
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.