Why network_mode: host?

[YeapGuy]

Can you elaborate on why you say "this fork has a dependency on network_mode: host" and similar in the readme? I'd like to avoid using network_mode: host for security and maintainability.

[Zoey2936]

• you don't need to enable ipv6 in the docker daemon and in the compose yaml
• you can connect npmplus to non docker services bound to localhost
• you don't need to use docker networks to connect npmplus to the container, since you can expose the ports of the container to localhost (example: 127.0.0.1:5678:5678) and the in npmplus just proxy to http(s) 127.0.0.1 and port 5678
• you can connect to crowdsec without having npmplus and crowdsec in the same docker network
• crowdsec could also run on host
• you can't forgett exposing ports
• you can't forgett exposing 443/udp
• you can still have protection using ufw for example

[YeapGuy]

Thank you. ❤️ Keeping these things in mind, I think I don't need network_mode: host with how I have things set up.

[DerLeole]

Thank you for your work on this awesome project!

Since I had to search a bit for this explanation and with the reasons stated not being hard dependencies as far as I can see, would it be possible to change the phrasing in the main Readme a bit, @Zoey2936 ?

• Linking this answer directly next to the stated dependency could clear up some confusion for users like me.
• Additionally maybe restating it from "this fork has a dependency on network_mode: host" to something like "We recommend network_mode: host for a number of reasons, which are elaborated here" could also make things clearer. I personally (mistakenly) pushed back the adoption of NPMplus in my own setups (personal + work) due to this statement, as I rely heavily on docker networks and so do many colleagues in my experience. This would also set it apart from applications like DHCP servers that need host network access for core functionality and can't be configured any other way.

[Zoey2936]

you can open a PR if you want. I used this hard wording because there was a high change that either people don't expose 443/udp, don't enable ipv6 or ask why crowdsec does not work (since the guide is written for network_mode host). But yes maybe the wording is too hard/confusing.

[Revan335]

But why is this (Host) not the Default in the Docker Template? I used Unraid.

[Revan335]

And i must change the Unraid Port (80+443) to any other or a recommend Port?

[Zoey2936]

because the template is not by me