Docker opened up ports to public. How do I close them?

I'll answer the question that you did not ask and that you actually want to know, in the hopes it will help future readers, mostly because I bumped on the issue myself.

How to do it safe and properly?

I am assuming the default --iptables=true docker configuration.

The default --ip when binding a container port is 0.0.0.0 ie. all interfaces. So the container binds to all interfaces, ie. the port 1234 is redirected to port 80 from all incoming interfaces. Because the DOCKER chain is added in iptables nat table in PREROUTING chain, it is redirected usually before anything else normal firewalls insert in filter table.

To be safe, modify /etc/docker/daemon.json and specify the default ip the containers will bind to when redirecting ports:

{
    "ip": "127.0.0.1"
}

or add the command line option --ip=127.0.0.1 to your docker instance. That way ports when not specified will only insert redirections for localhost.

This may be not enough, as iptables rules can be strange - so knowing your iptables rules and modyfing them if needed is advisable. Alternatively you can add some filtering rule to DOCKER_USER chain in filter table to specifically filter the traffic.

And for instances that you really want to expose to outside world, explicitly set 0.0.0.0 (or the ip number of external interface):

ports:
- 0.0.0.0:1234:80    # global
- 127.0.0.1:1235:80  # local only
- 1236:80            # whatever defaults is set in docker.json, usually 0.0.0.0

How do I close them?

Stop docker service. Stop containers. Remove the rules from iptables. Shutdown your pc. Remove network connection from you pc.

I only want to have 80, 22, and 443 being open. How do I achieve that?

So redirect only those ports and nothing else.

How do I disable docker being able to open them up?

Disable iptables support in docker - pass --iptables=false to dockerd or modify /etc/docker/daemon.json accordingly.

Doing:

iptables -I DOCKER-USER -i eth0 ! -s 127.0.0.1 -j DROP

solved this for me.

https://www.jeffgeerling.com/blog/2020/be-careful-docker-might-be-exposing-ports-world

I recently needed to resolve the same issue in my linode server. Those are the steps that helped me to secure the server:

1. Disable IPTables for docker

echo "DOCKER_OPTS=\"--iptables=false\"" >>  /etc/default/docker

# add "iptables": false to /etc/docker/daemon.json
# if you don't have this file, you can run:
echo -e "{\n\"iptables\": false\n}\n" > /etc/docker/daemon.json

# restart docker
service docker restart

You should not have docker rules in iptables at this point.

2. Block entire income traffic except ports that are needed. I use ufw for it.

3. Create nginx proxy if you need to forward 80 to the docker container port.