progrium/dokku — pull request #557 by psm14 (2014-04-24 00:29:09+00:00)
Title: Expose less ports from the host

Nginx running on the host is capable of forwarding directly into containers without needing port 5000 to be exposed from each one.

Say "SiteA" and "SiteB" are running in containers. Currently, in master, port 5000 on both of them would be mapped to a port in the 49000-49900 range. Let's say SiteA gets 49001 and SiteB gets 49002, for example. Someone could connect to "http://sitea.example.com:49002/" to be connected to SiteB's container, and likewise "http://siteb.example.com:49001/" goes to SiteA. In addition to being unwieldly, someone could enumerate every standard dokku container running on the machine by simply scanning the 49000-49900 range, which may or may not have security/architecture/whatever implications.

This PR changes this by configuring nginx to forward directly to the container's private 172.17.*.* address. Unfortunately, it causes any of the nginx/vhost related plugins to break since they currently assume they can forward to "127.0.0.1:$PORT". This is an easy fix; the changes made to the post-deploy hook of the default nginx-vhosts plugin in this PR can be used as an example.