title: ACL on Docker overlay network
body: <p>I have a relatively large Docker swarm with several dozen micro-web-services running on it.</p>
  
  <p>As only two or three of these services need external access, most of the inter-container/service communication happens over a single overlay network.</p>
  
  <p>In the interests of tightening platform security I would like to impose some service-name based access control on the overlay network to prevent container 'cross-talk'.</p>
  
  <p>There doesn't seem to be an obvious way of doing this, and creating a new overlay network for every service link seems a little bit unmanageable?</p>
  
  <p>What I hope to accomplish is:</p>
  
  <pre><code>$ docker network create myoverlay -d overlay
  $ docker service create --name web1 --net myoverlay apache
  $ docker service create --name web2 --net myoverlay nginx
  $ docker service create --name database1 --net myoverlay mysql
  $ docker service create --name database2 --net myoverlay cassandra
  
  web1 -&gt; database1 //allowed
  web2 -&gt; database2 //allowed
  
  web1 -&gt; database2 //denied
  web2 -&gt; database1 //denied
  </code></pre>