glenrobson / SimpleAnnotationServer

A simple IIIF and Mirador compatible Annotation Server
Apache License 2.0
97 stars 29 forks source link

Some suggestions for `runDocker.sh` #138

Open mk-pmb opened 2 years ago

mk-pmb commented 2 years ago

I'd have submitted my changes as a PR, but the repo turned out too huge to clone for just this simple script.

The ideas behind the changes:

Docker vs. ufw firewall

Problem: Lots of novice docker users are unaware of how to set the default bind IP address for their containers and are thus surprised if a project's docker scripts bind to ALL available network interfaces without asking. The effect is made worse because those novices usually also don't know that docker's port publishing has priority over ufw rules, so they might expect that the published ports would be firewalled.

Mitigation: I'd recommend a protect-by-default approach where any docker utility scripts included in a project should offer an easy way to configure a bind IP (e.g. via environment variable). In case that config is missing, the script should