I packaged an application into a single Docker container that exposes publicly a single port to the Internet, where it expects connections from a well-known service with a well-known and static IP address.

As this port is often probed by unauthorized users from somewhere in the Internet, I'd like to restrict connections to it from the known source addresses with a Netfilter rule.

The container itself is just a singleton, won't be scaled, and has no other dependencies.

Question is, should I apply the firewall rules on the host or in the container?

  • Keep in mind that docker updates iptables on the fly in order to do its own routing, so you cannot use any of the chains it is using (and definitely not UFW-style iptables management. You can add things to the DOCKER-USER chain and have those rules respected. docs.docker.com/network/iptables
    – JamesCW
    May 23 '18 at 19:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.