禁止从Docker容器到内部网络的流量

Question

I have a web application, where users can register and start containers with a few clicks. The creation of the container is done by commuication of my web application with the docker deamon via tcp.

My problem now is, that the user can also upload binary files via FTP into their docker volume. All binaries are loaded after a start of the container. So people could run every piece of code inside of the container and also start sending packets in my internal network to unsecured endpoints. From inside of the container I can ping the docker host and other nodes, that are in my local network.

My goal is, that the containers should only be able to communicate with endpoints outside of my network. Is there a way, to achieve this desired behaviour?

Answer 1

This is not really a docker specfic problem. It seems what you want to do is block access from an internal network range (let's call it docker-range ) to your other internal network hosts, but still allow docker-range access to the public internet.

You need to change your routing and firewall settings to achieve this. If you are on Linux, I would suggest to use iptables .

With the example bridge network configuration given in the docker docs this could look similar to

sudo iptables -A FORWARD --source 192.168.1.5/24 --destination 10.0.0.0/24 -j REJECT

source would be your docker bridge network ( docker-range ), --destination would be your other internal hosts.

You need to make sure that the traffic from the docker containers goes through this firewall. Usually, you would apply the configuration at the router set as default-gateway in the docker bridge network configuration.