Django app in docker compose seems to be getting brute forced url requests with a docker ip

Question

I have a cookiecutter-django based setup with docker-compose, with a mailing service from Mailjet with Anymail on a VPS on Vultr for staging. I use traefik as a reverse-proxy.

I occasionally get emails from the app for 404 errors when I or my partner tries an invalid link.

But since 3 days ago, I have been gettings hundreds of emails a day for 404 errors with url paths that can be considered usual defaults for many different frameworks such as /login, /Home/Login, /static/style.css, etc.

That in itself would have been easy to fix, if Traefik was the container receiving the requests. No, the emails all say I'm getting the request from 172.19.0.08, whereas my project (nothing else is running in this VPS to my understanding) uses 172.20.0.X as the network.

I even set up a RateLimit middleware in traefik but it was pointless since the requests never go through traefik.

I am not very good at networks so I do not know how to identify what is happening here. Django logs don't show the requests either to my understanding although I don't have a very detailed django logging config set up (used default from cookiecutter with DEBUG as the level).

What could be the possible reason for this?

Answer 1

You are correct that your issue is related to the networking setup. Your application is receiving web traffic that is bypassing your reverse proxy and hitting your Django app directly.

The pattern of requests suggests that they are done by an automated scanner/bot used to look for vulnerabilities in web applications. It's a security issue.

Check if the port Django is running on is exposed directly to the public. If so, that means anyone could access your app bypassing Traefik. Ensure only the necessary ports (like the ones used by Traefik) are exposed to the public. For instance, if your Docker Compose file has a line like ports: - "8000:8000" for your Django app, consider removing it and letting only Traefik expose necessary ports.

Check your VPS's firewall settings. Make sure that the only ports open to the outside world are those necessary for your application and Traefik to function properly.