Hello François-Xavier, I can't speak to best practices or broadly acceptable recommendations, but below is what I would try. For each container that doesn't need to talk to any other container, set `network_mode: none` for that container's entry in the `services:` top-level element. Please note that I haven't personally tried combining `network_mode: none` with `ports:` within the same container, so if that doesn't work as I described that may be my fault. For each container that needs to talk to another container, define a network in the `networks:` top-level element with `internal: true` set for it. In each container's entry in the `services:` top-level element, include that network in `networks:`. In either case, these should prevent the default behaviour of attaching containers to the default network, which is what normally gives broad outbound network access to containers. No iptables commands should be needed. If you only want the containers' exposed ports to be accessible on the machine running the containers, specify 127.0.0.1 in addition to the port(s) themselves in each container's `ports:` section (syntax here: https://github.com/compose-spec/compose-spec/blob/master/05-services.md#port...). For syntax and extra options, I would look here: https://github.com/compose-spec/compose-spec/blob/master/spec.md Cheers, -Keith On Wednesday, July 10th, 2024 at 7:46 PM, François-Xavier Thomas <fx.thomas@gmail.com> wrote:
Hello all,
I was wondering what was the current recommended way to restrict network access of containers?
I'm trying to setup a web service via 'podman compose' ; I like most of my web services (proxied through Nginx) to only have access to the lo interface, and while for other services this is done via a systemd unit setting I'm having trouble finding the equivalent for podman.
The following rules seem to work (I can also use -s/-d and specify the whole IP range used by containers):
iptables -t filter -I NETAVARK_FORWARD -i podman2 ! -o lo,podman2 -j DROP iptables -t filter -I NETAVARK_FORWARD -o podman2 ! -i lo,podman2 -j DROP
However, I'm not sure when the NETAVARK_FORWARD table is created (should I even use this table?), and the podman2 interface also does not exist before the network is created (when running 'podman compose up').
Is there a way to run these commands when the containers are brought up, like some kind of pre-up script? Is there a better way of achieving what I'm trying to do?
Thanks for your help, François-Xavier _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io