Send mail from a container using a postfix container

Question

I'm using an application hosted on a docker container. This application executes bash scripts / instructions to send mails. I made another container which executes Postfix as a SMTP Relay.

I want to send mails from my application container by using a bash script using my Postfix container as a relay.

I tried to connect with SSH from my application container to my Postfix container. But that doesn't seem to work.

How can i make it so a script executed in my application container can use my Postfix relay while not allowing anything outside of the docker network, or even better, to only allow some containers, to send mails from this relay.

EDIT 1 : Docker-compose files

Application docker compose :

version: "3.4"
volumes:
  [...]

services:
application:
    restart: always
    build: ./application
    depends_on:
    - mariadb
    container_name: application
    volumes:
      [...]
    ports:
      - "80:80"
      - "443:443"
      - "5669:5669"
    deploy:
      restart_policy:
        window: 300s
    links:
      - mariadb
    external_links:
      - smtp-server

  mariadb:
    restart: always
    image: mariadb
    command: mysqld --sql-mode=ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
    container_name: application-mariadb
    volumes:
    [...]
    environment:
      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
    deploy:
      restart_policy:
        window: 300s

Here's my docker compose for my SMTP server : version: "3.4"

services:
 postfix:
   restart: always
   build: ./postfix
   container_name: smtp-server
   deploy:
     restart_policy:
        window: 300s

Answer 1

{a quick response, because I "cicle" in my work ... and I'm taking 10 minutes of clear my mint, I hope it serves you}

Are you using "docker-compose" ?, could you give an example of your YML file? (a little more context)

[you can not connect to by ssh to a container unless you have " supervisor " installed,which I do not recommend at all.]

from what I see, you only need to make private networks; You could use this:

https://docs.docker.com/compose/networking/

to hide everything, I also recommend using a load balancer / Inverse Proxy like TRAEFIK (if they have access to port 80 or 443 in some clear way this ...)

so you only expose 1/2 port(s) (80 + 443 for example) and everything else is protected by your reverse proxy

Watch as I separate the networks as you need the different containers.

• bash have access to db and smtp
• db does not have access smtp neither nginx
• nginx have access to bash

• nginx have access to proxy network to expose 80 and 443

• no other container is exposed to the outside more than nginx

--

version: "3"
services:
  bash:
####### use hostname "smtp" as SMTP server
    image: bash
    depends_on:
      - db
    networks:
      - smtp_internal_network
      - internal_network
      - data_network
    volumes:
      - ../html:/var/www/html
    restart: always
  db:
    image: percona:5.7
#    ports: # for debug connections and querys
#      - 3306:3306
    volumes:
      - ../db_data:/var/lib/mysql
    environment:
      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD}
      MYSQL_DATABASE: ${MYSQL_DATABASE}
      MYSQL_USER: ${MYSQL_USER}
      MYSQL_PASSWORD: ${MYSQL_PASSWORD}
    networks:
      - data_network
    restart: always
  smtp:
    image: mwader/postfix-relay
    environment:
      - POSTFIX_myhostname=smtp.domain.tld
    networks:
      - smtp_internal_network
    restart: always
  nginx:
    image: nginx
    volumes:
      - ../html:/var/www/html
    networks:
      - external_network
      - internal_network
  labels:
      - "traefik.backend=nginx_${COMPOSE_PROJECT_NAME}"
      - "traefik.port=80"
      - "traefik.frontend.rule=Host:${FRONTEND_RULE}"
      - "traefik.frontend.passHostHeader=true"
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_proxy"
   restart: always
   depends_on:
      - db
      - bash


networks:
  external_network:
    external:
      name: traefik_proxy
  internal_network:
    driver: bridge
  smtp_internal_network:
    driver: bridge
  data_network:
    driver: bridge

---

Edit:

version: "3"
volumes:
  [...]

services:
 ####### use hostname "smtp" as SMTP server in your application
  application:
    restart: always
    build: ./application
    depends_on:
    - mariadb
    volumes:
      [...]
    ports:
      - "80:80"
      - "443:443"
      - "5669:5669"
    deploy:
      restart_policy:
        window: 300s
    networks:
      - smtp_external_network
      - data_network

  mariadb:
    restart: always
    image: mariadb
    command: mysqld --sql-mode=ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
    networks:
      - data_network
    volumes:
    [...]
    environment:
      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
    deploy:
      restart_policy:
        window: 300s

networks:
  smtp_external_network:
    external:
      name: [ReplaceForFolderParentNameOfSmtpYmlWithoutSquareBrackets]_smtp
  data_network:
    driver: bridge

--- (in your other file)

services:
 smtp:
   restart: always
   build: ./postfix
   networks:
     - smtp
   deploy:
     restart_policy:
        window: 300s

networks:
  smpt:
    driver: bridge