I have a new application that I've created via a docker-compose file. This file contains 2 networks:
version: '2.1'
# ----------------------------------
# Services
# ----------------------------------
services:
application:
image: tianon/true
volumes:
- ${APPLICATION_PATH}:/var/www
nginx:
build:
context: ./docker/nginx
volumes_from:
- application
volumes:
- ${DOCKER_STORAGE}/nginx-logs:/var/log/nginx
- ${NGINX_SITES_PATH}:/etc/nginx/sites-available
ports:
- "${NGINX_HTTP_PORT}:80"
- "${NGINX_HTTPS_PORT}:443"
networks:
- frontend
- backend
redis:
build:
context: ./docker/redis
volumes:
- ${DOCKER_STORAGE}/redis:/data
ports:
- "${REDIS_PORT}:6379"
networks:
- backend
# ----------------------------------
# Networks
# ----------------------------------
networks:
frontend:
driver: "bridge"
backend:
driver: "bridge"
# ----------------------------------
# Volumes
# ----------------------------------
volumes:
redis:
driver: "local"
You'll notice I have 2 networks here, frontend
and backend
. The question is simple:
- How do I expose
frontend
to the world, but allowbackend
services to communicate with each other without exposing them to the world? (I'm assuming using iptables, or specifying in docker which network I want to expose to the host) - This is a simple 1 server setup (Digital Ocean), running Ubuntu 18.04 LTS
- In the example above, I should be able to access nginx from the outside world on port 80 or 443, but NOT redis. Nginx container should be able to access redis service 6379 internally.
- To be more clear: My intent right now is for the backend services to communicate with each other for now, so removing EXPOSE would work now, but ultimately, I want to partition the 2 networks. The backend services, I want to restrict IP ranges to (Allow some other non docker networks to communicate), and the frontend services I want to open exposed ports to the world.
For the bounty: There's clearly a way in docker to define multiple overlay networks. I had assumed, it would be simple to just expose one network to the outside world. I'm trying to find an easy way in docker or iptables to do that. The current answer gives me some direction, but requires manual rules for each port. I'd like a proper answer on how to secure my "frontend" facing network, without having to specify specific ports in iptables.