Docker Restricting container network access Block access from containers to the local host running docker daemon (custom network)
Example
docker network create --subnet=192.168.0.0/24 --gateway=192.168.0.1 --ip-range=192.168.0.0/25 local-host-restricted
iptables -I INPUT -s 192.168.0.0/24 -m addrtype --dst-type LOCAL -j DROP
Creates a network called local-host-restricted which which:
- Blocks
- Access to host running docker daemon
- Does not block
- Container to container traffic
- Local LAN
- Internet
- Access originating from other docker networks
Custom networks have bridge names like br-15bbe9bb5bf5, so we uses it's subnet instead.
