docker makes port of container open to public

user_1618073 0
Viewed 2694

I have on centos7 docker container with nginx.

Port 80 is available from outside despite on that this port NOT opened in firewalld. here rules for public zone:

# firewall-cmd --zone=public --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eno3
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

but there is a automatic rule for this port in chain DOCKER:

# iptables -L DOCKER
Chain DOCKER (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:http

how to CLOSE this port from outside? I've ran the command but it not helped:

# firewall-cmd --zone=public --remove-port=80/tcp --permanent
Warning: NOT_ENABLED: 80:tcp
success

I've read docs - https://docs.docker.com/engine/userguide/networking/ but still don't get it.. Actually I need open this port 80 only for my specified network 1.2.3.4/24.

firewalld centos7 docker port containers
2 Answers

Maybe a bit overdue, but:

you probably are mapping with something like 3000:3000. This is very much the equivalent of 0.0.0.0:3000:3000.

What you want is to map only to your localhost. You can achieve this by listening to a specific IP address, such as 127.0.0.1 (localhost).

Change your configuration to 127.0.0.1:[host_port]:[container_port].

user_109312080
Related