Getting started with Docker Running containers Managing containers Managing images Building images Docker swarm mode Docker Data Volumes Debugging a container Inspecting a running container Docker Machine Dockerfiles Docker network Data Volumes and Data Containers Docker Engine API Multiple processes in one container instance Docker Registry Checkpoint and Restore Containers Docker stats all running containers Concept of Docker Volumes Docker events Restricting container network access run consul in docker 1.12 swarm Dockerfile contents ordering docker inspect getting various fields for key:value and elements of list passing secret data to a running container Connecting Containers Logging Creating a service with persistence Docker in Docker security How to debug when docker build fails Docker private/secure registry with API v2 Running Simple Node.js Application Running services Iptables with Docker Docker --net modes (bridge, hots, mapped container and none).How to Setup Three Node Mongo Replica using Docker Image and Provisioned using Chef

Restricting container network access

Remarks:

Example docker networks that blocks traffic. Use as the network when starting the container with --net or docker network connect.

Block access to LAN and out

docker network create -o "com.docker.network.bridge.enable_ip_masquerade"="false" lan-restricted

Blocks
- Local LAN
- Internet
Does not block
- Host running docker daemon (example access to 10.0.1.10:22)

Block access to other containers

docker network create -o "com.docker.network.bridge.enable_icc"="false" icc-restricted

Blocks
- Containers accessing other containers on the same icc-restricted network.
Does not block
- Access to host running docker daemon
- Local LAN
- Internet

Block access from containers to the local host running docker daemon

iptables -I INPUT -i docker0 -m addrtype --dst-type LOCAL -j DROP

Blocks
- Access to host running docker daemon
Does not block
- Container to container traffic
- Local LAN
- Internet
- Custom docker networks that doesn't use docker0

Block access from containers to the local host running docker daemon (custom network)

docker network create --subnet=192.168.0.0/24 --gateway=192.168.0.1 --ip-range=192.168.0.0/25 local-host-restricted
iptables -I INPUT -s 192.168.0.0/24 -m addrtype --dst-type LOCAL -j DROP

Creates a network called local-host-restricted which which:

Blocks
- Access to host running docker daemon
Does not block
- Container to container traffic
- Local LAN
- Internet
- Access originating from other docker networks

Custom networks have bridge names like br-15bbe9bb5bf5, so we uses it's subnet instead.

Contributors

Topic Id: 6331

Example Ids: 21850,21851,21852,21853

This site is not affiliated with any of the contributors.