Question 83577 in Docker Question posted in
The official documentation can be found here.

How to prevent docker containers from accessing my local network

I would like to be able to prevent docker containers connected to a bridge network from accessing my local network in order to add extra security since they will be accessible from outside (in case a container is compromised). I saw that I should probably use ebtables or the physdev module of iptables but I can’t create a rule that works. Thanks to the one who can help me.

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    After some research and if anyone is interested, it is possible to use ebtables.

    # Authorize DNS queries
ebtables -A INPUT -p IPV4 --ip-protocol TCP --ip-destination-port 53 --ip-destination 192.168.1.1 --ip-source 172.18.0.0/16 -j ACCEPT
ebtables -A INPUT -p IPV4 --ip-protocol UDP --ip-destination-port 53 --ip-destination 192.168.1.1 --ip-source 172.18.0.0/16 -j ACCEPT
# Drop all others packets
ebtables -A INPUT -p IPV4 --ip-destination 192.168.1.0/24 --ip-source 172.18.0.0/16 -j DROP

    Do not forget to replace the 172.18.0.0/16 subnet with the one on which your containers are connected.


  2. 0

    I was stumbling through this myself and found one solution was to insert (-I) a new rule into the DOCKER-USER chain.

    Please see this answer: https://stackoverflow.com/a/73994723/20189349

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search