The gp container runs WordPress 4.8.28 on PHP 7.2 (both EOL). It's hardened with the following measures:
| Measure | Detail |
|---|---|
| Dedicated proxy network | gp-proxy - only nginx-proxy and gp, isolated from other app containers |
| Dedicated DB network | gp-database - only gp and gpdb |
| Read-only webroot | /data/SitoGpea2012:/var/www/html:ro |
| No outbound internet | iptables DROP rules in DOCKER-USER chain |
| No host ports | Accessed only via reverse proxy |
| No privileged mode | Standard container capabilities |
Applied via /usr/local/bin/gp-firewall.sh, persisted via gp-firewall.service (systemd, runs after docker.service).
The script:
docker inspectIf the site breaks due to needing internet (e.g., plugin update):
# Temporarily remove firewall rules
systemctl stop gp-firewall
iptables -L DOCKER-USER -n --line-numbers # find the DROP rules
iptables -D DOCKER-USER <rule_number> # remove them
/usr/local/bin/gp-firewall.sh - firewall script/etc/systemd/system/gp-firewall.service - systemd unit