trafficjam VS whalewall

This is always a security vs convenience battle. Some time ago someone mentioned trafficjam https://github.com/kaysond/trafficjam which might be the solution for this. This way you can easily create one traefik network and let trafficjam take care of the firewall rules on this network so you container on that network are only allowed to talk to traefik.

Awesome! I did something similar, for a much more specific use case (isolate containers on a shared reverse proxy network) using bash (makes reading the code very easy). See https://github.com/kaysond/trafficjam

Or you can try this containerized firewall I wrote to address this very problem: https://github.com/kaysond/traefikjam You put your reverse proxy and all your web containers on one network, then the firewall daemon adds iptables rules to prevent containers from talking to each other except the reverse proxy can talk to everything.

It took me a long time to notice this issue, and I've found this as a possible solution. Working on deploying it, and will see how it goes.

Look into ufw (or iptables/nftables if you want to go deeper) to restrict outbound network access. Note though that Docker containers won't respect host firewall rules by default, so I created whalewall to easily manage container firewall rules: https://github.com/capnspacehook/whalewall

I recently found out that Docker containers ignore any host-based firewall rules by default and wanted a solution to restrict container traffic. This weekend I finally finished a project to do just that: https://github.com/capnspacehook/whalewall