{"action":"created","issue":{"url":"https://api.github.com/repos/moby/moby/issues/37309","repository_url":"https://api.github.com/repos/moby/moby","labels_url":"https://api.github.com/repos/moby/moby/issues/37309/labels{/name}","comments_url":"https://api.github.com/repos/moby/moby/issues/37309/comments","events_url":"https://api.github.com/repos/moby/moby/issues/37309/events","html_url":"https://github.com/moby/moby/issues/37309","id":333637523,"node_id":"MDU6SXNzdWUzMzM2Mzc1MjM=","number":37309,"title":"[New feature] Ability to restrict connection between containers","user":{"login":"Yivan","id":9025839,"node_id":"MDQ6VXNlcjkwMjU4Mzk=","avatar_url":"https://avatars0.githubusercontent.com/u/9025839?v=4","gravatar_id":"","url":"https://api.github.com/users/Yivan","html_url":"https://github.com/Yivan","followers_url":"https://api.github.com/users/Yivan/followers","following_url":"https://api.github.com/users/Yivan/following{/other_user}","gists_url":"https://api.github.com/users/Yivan/gists{/gist_id}","starred_url":"https://api.github.com/users/Yivan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Yivan/subscriptions","organizations_url":"https://api.github.com/users/Yivan/orgs","repos_url":"https://api.github.com/users/Yivan/repos","events_url":"https://api.github.com/users/Yivan/events{/privacy}","received_events_url":"https://api.github.com/users/Yivan/received_events","type":"User","site_admin":false},"labels":[{"id":237472034,"node_id":"MDU6TGFiZWwyMzc0NzIwMzQ=","url":"https://api.github.com/repos/moby/moby/labels/area/networking","name":"area/networking","color":"fbca04","default":false},{"id":381838255,"node_id":"MDU6TGFiZWwzODE4MzgyNTU=","url":"https://api.github.com/repos/moby/moby/labels/platform/desktop","name":"platform/desktop","color":"F6FBFF","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-06-19T11:52:37Z","updated_at":"2018-06-21T15:40:53Z","closed_at":null,"author_association":"NONE","body":"Use case:\r\nWe are using Docker to create a specific environement for each of our project.\r\nThis means each project containers should not be linked with other projet containers.\r\nEach project for instance as an apache container, a php container, a mysql container, elasticsearch container, etc.\r\nWe wanted each php container access only to the mysql container and elasticsearch container of the project for instance.\r\n\r\nI spend lot of time and tries to find a way to resolve this classic case with proper, simple and elegant solution... with no luck. So i think there is something missing and docker could be improved maybe.\r\n\r\nActual solutions:\r\n- create a network for each project so containers of the projet can communicate only between them. This approach is limited as (without swarm which has overlay network and can create 65k network)\r\n  - number of network is limited to 31 (for reference: https://loomchild.net/2016/09/04/docker-can-create-only-31-networks-on-a-single-machine/), so no more than 31 projects possible.\r\n  - create many networks tends to make the host slower (if you make a loop to create 31 network, the first ones will create fast, but the last ones it will be long ; ))\r\n\r\n- use the default network bridge -icc option and link container:\r\n  - using \"link\" is deprecated (https://docs.docker.com/network/links/)\r\n  - -icc seems to give some problem on some hosts (need br_netfilter activated on the host...)\r\n  - this solution only work with the default bridge network, not custom create ones\r\n\r\n- create a custom network bridge with -icc set to false:\r\n  - \"link\" deprecated feature don't work for custom network with icc false\r\n  - need to add manually rule in iptables (not possible with Docker for Windows for instance as we cannot accesss to the VM without some really dirty hackink involving nscenter and privilege excalation)\r\n\r\n- use a reverse-proxy (traefik, nginx reverse proxy, ...):\r\n  - work ok for http connection (or protocol supported by the reverse proxy), but tiedous to configure as for instance with traefik you need to limit by IP and in docker-compose you don't kown the ip...\r\n  - we have to handle service url, etc...\r\n\r\n**If you think of other solutions you can propose them in this issue please so this could help people. Thanks.**\r\n\r\nProposal:\r\nAn easy way to restrict connection on a container by only some container.\r\nFirst we could create a custom network disabling interconnectivity:\r\n`docker network create custom_global_network -o \"com.docker.network.bridge.enable_icc\"=\"false\"`\r\n\r\nInside a docker-compose file we could have something like a new option `network_container_allow` (maybe could be an option of the network bridge):\r\n\r\n```\r\nversion: \"3.5\"\r\n\r\nservices:\r\n    php:\r\n        ...\r\n        networks:\r\n            - custom_global_network\r\n\r\n    mysql:\r\n        ...\r\n        networks:\r\n            - custom_global_network:\r\n              - allow: \"php\"\r\n\r\n...\r\n```\r\n\r\nThis way the 31 network limitation is no more a problem (we can create as many docker project as needed), just to need to create one network (light for the host).\r\nThe option `allow` will automatically configure iptable so connection beetween containers will be possible. As they are already on the same network they can ping directly from the container name.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/moby/moby/issues/comments/399148603","html_url":"https://github.com/moby/moby/issues/37309#issuecomment-399148603","issue_url":"https://api.github.com/repos/moby/moby/issues/37309","id":399148603,"node_id":"MDEyOklzc3VlQ29tbWVudDM5OTE0ODYwMw==","user":{"login":"Yivan","id":9025839,"node_id":"MDQ6VXNlcjkwMjU4Mzk=","avatar_url":"https://avatars0.githubusercontent.com/u/9025839?v=4","gravatar_id":"","url":"https://api.github.com/users/Yivan","html_url":"https://github.com/Yivan","followers_url":"https://api.github.com/users/Yivan/followers","following_url":"https://api.github.com/users/Yivan/following{/other_user}","gists_url":"https://api.github.com/users/Yivan/gists{/gist_id}","starred_url":"https://api.github.com/users/Yivan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Yivan/subscriptions","organizations_url":"https://api.github.com/users/Yivan/orgs","repos_url":"https://api.github.com/users/Yivan/repos","events_url":"https://api.github.com/users/Yivan/events{/privacy}","received_events_url":"https://api.github.com/users/Yivan/received_events","type":"User","site_admin":false},"created_at":"2018-06-21T15:40:53Z","updated_at":"2018-06-21T15:40:53Z","author_association":"NONE","body":"Thanks @cpuguy83 for you answer.\r\n\r\nYes you are totally right, and like in the link in my original post, you can create manually more than 31:\r\n`for net in {1..50}; do docker network create -d bridge –subnet=172.18.${net}.0/24 net${net} ; done`\r\n\r\nBut in this case you need to handle manually network creation (can be easily adressed), but network subnet availabilities too (available network subnet for creation) for each project and this last one is the tricky part (when you up a docker compose stack, you will need to look for available subnet manually...).\r\nDocker already assign automatically this by just running `docker network create -d bridge mynetwork`, but is limited to 31 in this case.\r\n**Could this limit be improved ?** (something like 1000 network so it will be enough for all case... more than 1000 network, the host will have performance pbl i think ; )).\r\nBut actually 31 networks is really short... I really like the designed network features, but this limitation is for some use-case a blocking point.\r\n"}}
{"actor":{"display_login":"Yivan"}}