Allow docker container to connect to certain IP addresses only

Question

The goal is to create a docker container that can connect only to certain IP addresses (both on the local network that the host belongs to, and on the Internet).

The container itself does not need to be directly accessible or expose any ports.

Example:

1. Docker host machine 192.168.1.100
2. Some device on 192.168.1.150 e.g. an IP camera
3. Some cloud VPS on <static_ip>

— need to create a container that can ssh to <static_ip> and connect to the device 192.168.1.150 but cannot connect to anything else whatsoever (specifically no other containers on the host, nothing else on the 192.168.1.0 network, and perhaps even nothing else on the Internet apart from the VPS).

Note that the host runs other containers with various services on them, and those must not be interfered with.

After some research I found that I probably should create a custom bridge network like this:

docker network create --driver bridge \
-o "com.docker.network.bridge.enable_icc"="false" \
my-restricted-network

and then run the container on that network:

docker run --name my-restricted-container \
--network my-restricted-network \
-d image_name /entrypoint.sh

What do I need to do then? I guess add some iptables rules on the host which will control my-restricted-network only. How exactly?

Answer 1

Okay, after half-an-hour of RTFM I found the solution.

All on the docker host:

1. Find interface ID of my-restricted-network:

docker network ls | grep my-restricted-network
38d3c24a48ad   my-restricted-network   bridge    local

2. Insert the following rules:

iptables -I DOCKER-USER -i br-38d3c24a48ad -j DROP
iptables -I DOCKER-USER -i br-38d3c24a48ad -d 192.168.1.150 -j ACCEPT
iptables -I DOCKER-USER -i br-38d3c24a48ad -d <static_ip> -j ACCEPT