I would like to restrict access to my docker host and containers to only be allowed from one source IP (actually I want to create more elaborate rules than this, but I need to figure out this basic task first)... how can I do this?
I tried iptables -I DOCKER-USER -i ens33 ! -s 10.0.0.100 -j DROP
with my IP address being 10.0.0.100, but I can still ping the docker host from other IP addresses on my LAN.
The docker documentation (https://docs.docker.com/network/iptables/) states "Docker installs two custom iptables chains named DOCKER-USER and DOCKER, and it ensures that incoming packets are always checked by these two chains first."
The documentation has a section titled "Restrict connections to the Docker host", which is exactly what I want to do, however it does not seem to actually describe how to do just that. This section is where I got the example rule from above, but despite the section heading, this rule is described as restricting access to a docker container and not restricting access to the docker host. So how do I actually restrict access to the docker host?
sudo iptables -I INPUT -i ens33 ! -s 10.0.0.100 -j DROP
does indeed restrict access to the host from other IP addresses, but it seems to go against the documentation and I am not sure if this will cause some problems with docker?