0
I have an answer which will limit docker containers to only be able to access a single IP address outside the host. Using this iptables rule on the host:
iptables -I FORWARD -i docker0 ! -d 8.8.8.8 -j DROP
means that from inside any docker containers it is only possible to access the IP address 8.8.8.8.
This is fairly drastic - basically, if the destination is NOT 8.8.8.8 then drop the packet.
What is the best way that I can set up rules which would allow me limit the containers to a certain number of IP addresses?
i'm no expert but how about removing the exclamation mark and changing the end from DROP to ALLOW then you can add other rules for other IP Addresses. And you can change the forward policy to drop too. So that the ones you allow are exceptions that you allow. So you have a whitelist – barlop – 2015-06-02T15:00:14.290
This is an unusual requirement. I have seen a solution that could be adapted to your case without breaking Docker's link facility. Could you tell us more about your application and why it requires a white list for out-boud connections? – Arnaud Meuret – 2015-07-27T14:24:16.537