From 637123b39be182778d7e002a220e628673f60a73 Mon Sep 17 00:00:00 2001 From: Tianon Gravi Date: Thu, 22 Jul 2021 17:11:54 -0700 Subject: [PATCH] Add a warning about the extreme insecurity of FPM exposed externally --- php/variant-fpm.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/php/variant-fpm.md b/php/variant-fpm.md index 5093b6ce2..06ba66065 100644 --- a/php/variant-fpm.md +++ b/php/variant-fpm.md @@ -11,3 +11,5 @@ Some potentially helpful resources: - [very detailed article by Pascal Landau](https://www.pascallandau.com/blog/php-php-fpm-and-nginx-on-docker-in-windows-10/) - [Stack Overflow discussion](https://stackoverflow.com/q/29905953/433558) - [Apache httpd Wiki example](https://wiki.apache.org/httpd/PHPFPMWordpress) + +**WARNING:** the FastCGI protocol is inherently trusting, and thus *extremely* insecure to expose outside of a private container network -- unless you know *exactly* what you are doing (and are willing to accept the extreme risk), do not use Docker's `--publish` (`-p`) flag with this image variant.