Make docker only use one specific NIC

I don't see reason to use host network for the container (host network = --net=host parameter for container). Why you don't use default container networking and then just publish ports on the correct IP with the advance publish port syntax (-p IP:host_port:container_port), e.g.:

-p <eth1-ip-address>:<host-app-port>:<container-app-port>

Doc: https://docs.docker.com/config/containers/container-networking/#published-ports

Of course you can use host network for the container = --net=host parameter for container, but then don't bind all interfaces from the app (0.0.0.0:<app-port>), just start app on the specific eth1 IP.

I can at least partially answer my own question. When specifying the "ip" parameter in docker's daemon.json, only newly created containers will respect that setting and only bind to the configured IP address. However, it is not enough to recreate an existing container, it will still bind to both NICs. You really have to delete any misbehaving containers including their volumes and configs and start from scratch. I have yet to find a way to just change the binding without having to do that.

From the official docs / networking section

If you want to be more restrictive and only allow container services to be contacted through a specific external interface on the host machine, you have two choices. When you invoke docker run you can use either -p IP:host_port:container_port or -p IP::port to specify the external interface for one particular binding. Or if you always want Docker port forwards to bind to one specific IP address, you can edit your system-wide Docker server settings and add the option --ip=IP_ADDRESS. Remember to restart your Docker server after editing this setting.

Found some additional OS level security measures so you dont have to rely on a config file alone.

commercial hypervisor setup guides mention using 'ip-netns' to segment and isolate nics. https://man7.org/linux/man-pages/man8/ip-netns.8.html

as a last resort you could edit the loopback iptable rules and block cross nic communication that way

Came across this problem whilst running up a pihole instance per VLAN and wanting to run up a series of docker containers within the one LXC container on proxmox.

EDIT: the information given below is INCORRECT! I did in fact need to create a macvlan and attach that to the NIC. Otherwise the traffic hits the NIC but never goes any further.

At first I thought I might need to create individual docker networks per instance, then attach each network to an external NIC. Luckily, this was not the case.

My solution was to attach a NIC to the LXC container for each VLAN and assign each interface a static ip address (10.0.x.53).

Then, use the <host ip>:<host port>:<docker port> syntax inside a docker-compose file for each instance of pihole. Each pihole container was named pihole-N, where N is the tag value of that VLAN. This simply forwards the traffic from the desired NIC, straight into each docker container on the desired port.

Here is an example of just one of these instances:

version: "3"

# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
services:
  pihole:
    container_name: pihole-10
    image: pihole/pihole:latest
    ports:
      - "10.0.10.53:53:53/tcp"
      - "10.0.10.53:53:53/udp"
      - "10.0.10.53:67:67/udp"
      - "10.0.10.53:80:80/tcp"
    environment:
      TZ: 'UTC'
      WEBPASSWORD: <password>
    # Volumes store your data between container upgrades
    volumes:
      - '/opt/pihole-10/etc-pihole/:/etc/pihole/'
      - '/opt/pihole-10/etc-dnsmasq.d/:/etc/dnsmasq.d/'
    # Recommended but not required (DHCP needs NET_ADMIN)
    #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
    cap_add:
      - NET_ADMIN
    restart: unless-stopped