Скачать или смотреть How to Securely Expose Docker Container Ports to Host and Other Containers

Learn how to set up Docker containers to communicate only with the host and each other without exposing ports to the internet for enhanced security.
---
This video is based on the question https://stackoverflow.com/q/70668677/ asked by the user 'zantetsuken2718' ( https://stackoverflow.com/u/4072604/ ) and on the answer https://stackoverflow.com/a/70668800/ provided by the user 'David Maze' ( https://stackoverflow.com/u/10008173/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Docker: Open Container port only to Host and other Containers on it, without opening to the internet

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
How to Securely Expose Docker Container Ports to Host and Other Containers

Creating and managing Docker containers can be a powerful way to build applications, especially for learning and development purposes. However, security is a critical consideration when exposing container ports. In this guide, we'll address a common question: How can you open container ports on your Docker environment without exposing them to the internet?

Understanding the Problem

When working on an ETL application involving multiple containers, such as a MySQL container and a Python container running with Redis, it's vital to ensure that while these containers can communicate with each other, they remain safe from external access. The main challenge is determining how to configure access to those containers correctly.

Key Considerations:

Communication: Ensuring that the containers can communicate with each other.

Security: Limiting port access to enhance the security of the host machine and your application.

The Solution

Default Container Communication

By default, if you do not configure any ports in your Docker Compose file or use the docker run -p options, the containers can still communicate with each other without being reachable from the host machine or any external source. This is ideal for local development environments where security is a concern.

Example of a Sample Compose Setup:

[[See Video to Reveal this Text or Code Snippet]]

In this setup:

The app service is accessible externally via port 8080.

The postgres and redis services do not have any ports exposed, making them safe from external connections.

Configuring Specific Port Bindings

If you need specific services to be accessible from the host machine for testing or development purposes, you can define ports with an optional bind address. By binding to 127.0.0.1, you make sure that the published ports are reachable from the host while still preventing external access.

Setting Up Ports with Bind Address:

[[See Video to Reveal this Text or Code Snippet]]

From non-container processes on the host, you would access PostgreSQL using localhost:54321.

For other containers defined in the same Docker Compose file, they can still access PostgreSQL using PGHOST=postgres and PGPORT=5432.

Conclusion

Using Docker efficiently while ensuring network security is crucial, especially when multiple containers interact. By understanding how to configure port bindings correctly, you can enhance your application's security without sacrificing functionality.

To summarize:

No port configuration means containers can communicate without external access.

Using bind addresses allows for controlled access to services on the host while keeping them secure.

By following these guidelines, you can safely work with Docker containers that communicate effectively while being shielded from unwanted external access. Happy coding!