Docker container exposed port vulnerabilities on Debian server?

Question

I'm configuring a Debian (Stretch) webserver to run docker containers for socks requests. So, the application would be able to authenticate (on port 1080) with the Dante server running inside the container and communicate with the web. I'm concerned about potential exploits, although I updated the iptables and set the conf to accept traffic only from the bridge driver's CIDR 172.27.0.0/16. The only information exposed I could find was using nmap:

sudo nmap -PN -p 1080 -sV 172.27.0.2

This prints out:

Starting Nmap 7.91 ( https://nmap.org ) at 2021-02-06 12:22 EET
Nmap scan report for 172.27.0.2
Host is up.

PORT     STATE    SERVICE VERSION
1080/tcp filtered socks

Only the service name socks is fetched (no version), compared to other services which print the version e.g.:

PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))

My questions are:

Authentication credentials are set as ENV variables, is the port secure to be exposed?

Can someone publicly access the container's ENV variables with some sort of scan tool?

Is gaining information that the port is additionally running docker or alike possible?

Are there tools apart from nmap that scan ports and return leaked info or vulnerabilities?

Any feedback is highly appreciated! I want to be sure not to make any mistakes and configure docker properly to accept only local requests from server-side scripts with no public access nor information leaks.

Answer 1

Authentication credentials are set as ENV variables, is the port secure to be exposed?

First off, that port isn't exposed at all, based on the "filtered" response. This is saying that nmap didn't receive any traffic back from this port. But no, information about processes on your system generally can't be retrieved by talking to arbitrary ports. However, if the Dante server itself has vulnerabilities, an attacker who can connect to the service could potentially exploit them and gain other information this way.

Can someone publicly access the container's ENV variables with some sort of scan tool?

Same as above, there is no link between that information and the port is inaccessible anyway.

Is gaining information that the port is additionally running docker or alike possible?

There is zero information returned about that port at all, so no, not remotely with your current setup. Docker isn't even involved; the packets aren't getting past your kernel.

Are there tools apart from nmap that scan ports and return leaked info or vulnerabilities?

Yes, many both free and paid. You can find network and vulnerability scanners by searching online.