Use iptables. I know it's a glib answer, but that's how hosting always worked until AWS came along and introduced filtering from an interface outside of the control of the OS.

That is a horrible glib answer.

I was supposed to get a EASY TO USE, READY TO GO, Mesos development environment. So now I have to ssh to 5 boxes and manually add iptables rules? Why don't I just install Mesos myself then?

Honestly this whole thing just reads to me as a marketing releases, not something I would recommend anyone to use.

If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked.

Digital Ocean has never, since their release, provided anything impressively technical with regard to their infrastructure. It's not surprising that this is half-assed as well.

>If the answer is 'use' iptables, fine, but then I would expect the automation that builds my cluster to do it for me, not leave me with a $200 a month cluster just waiting to get hacked.

Did you confirm that the tooling is indeed missing?

Yes, iptables is installed as a dependency of Docker, but is not configured to do anything:

		$ iptables -L -v
		Chain INPUT (policy ACCEPT 2172 packets, 459K bytes)
		pkts bytes target     prot opt in     out     source               destination

		Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
		pkts bytes target     prot opt in     out     source               destination
		0     0 ACCEPT     all  --  any    docker0  anywhere             anywhere             ctstate RELATED,ESTABLISHED
		0     0 ACCEPT     all  --  docker0 !docker0  anywhere             anywhere
		0     0 ACCEPT     all  --  docker0 docker0  anywhere             anywhere

		Chain OUTPUT (policy ACCEPT 2350 packets, 461K bytes)
		pkts bytes target     prot opt in     out     source               destination

Linode doesn't do this either. Nor do I want it to. It's my cluster and I should be responsible for firewalling it.

Given Linode's atrocious security record who cares what they do.

The default should always be to listen on internal interfaces or have firewalls pre-configured.