From dfc8a6abab08fbc4a277187dce91cffefac07abf Mon Sep 17 00:00:00 2001 From: thesabear Date: Thu, 27 Aug 2026 23:54:37 +0300 Subject: [PATCH] docs: update firewall-and-network-docker-bypass diagram --- assets/firewall-and-network-docker-bypass.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/assets/firewall-and-network-docker-bypass.svg b/assets/firewall-and-network-docker-bypass.svg index 72d8bae..cbf9cfd 100644 --- a/assets/firewall-and-network-docker-bypass.svg +++ b/assets/firewall-and-network-docker-bypass.svg @@ -1,4 +1,4 @@ -
Incoming Traffic
pfSense
Layer 1 — always applies
TARGET HOST — everything below this line is decided by what's running on it
firewalld
Layer 2 — native services only
Native Service
e.g. Alloy, Wazuh agent
Docker-published port
dozens of containerized apps
native path
Docker-published path

Solid orange — every packet, everywhere, always crosses pfSense first
Solid blue — native services get a second gate at the host level
Dashed red — the actual gap: Docker-published ports never reach firewalld
 \ No newline at end of file +
Incoming Traffic
pfSense
Layer 1 — always applies
TARGET HOST — everything below this line is decided by what's running on it
firewalld
Layer 2 — native services only
Native Service
e.g. Alloy, Wazuh agent
Docker-published port
dozens of containerized apps
native path
Docker-published path
Solid orange — every packet, everywhere, always crosses pfSense first
Solid blue — native services get a second gate at the host level
Dashed red — the actual gap: Docker-published ports never reach firewalld
 \ No newline at end of file