1

I'm ramping up on docker, and I would like to create a "internet only" network for one of my container: I want this container to only be able to access internet, it must not have any access to other containers or to the host.

I've thought about using iptables to do so, but I think directly creating a docker network would be more efficient and elegant. Nevertheless, I haven't been able to find how to create this "internet only" docker network.

Could you help me on this ?

Thanks !

Improve this question
0

2 Answers 2

Reset to default
0

If your network situation supports setting up vlans, Docker's macvlan network can put a container in a tagged vlan - and then have your router/firewall only allow that vlan to access the network resources you want. See here for more info.

Improve this answer
0

You can isolate the containers from each other by setting up a new network for that container

docker network create internetonly
docker run --rm -ti --network internetonly fedora:25 /bin/bash

It will not be able to connect to existing containers, although any future containers you start with --network internetonly will be able to communicate with each other. If you don't want that, give them all separate networks (but iptables will probably be more convenient then)

Unfortunately, this doesn't protect the host, as the docker network will need it as an outbound route.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .