title: Restrict internet access to docker container?
body: <p>What is the best way to restrict internet access to a single docker container while still forwarding ports?</p>
  
  <p>My current way of doing this works like this:</p>
  
  <pre><code>sudo docker network create --internal --subnet 10.1.1.0/24 no-internet
  sudo docker run --name gitlab -d -p 80:80 -p 822:22 --restart always gitlab/gitlab-ce
  sudo docker network connect no-internet gitlab
  sudo docker network disconnect bridge gitlab
  </code></pre>
  
  <p>The problem is that if I restart the system the ports are not forwarded anymore:</p>
  
  <p><code>sudo docker ps</code> before reboot:</p>
  
  <pre><code>CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                             PORTS                                              NAMES
  2d2a062744ec        gitlab/gitlab-ce    "/assets/wrapper"   13 seconds ago      Up 13 seconds (health: starting)   0.0.0.0:80-&gt;80/tcp, 443/tcp, 0.0.0.0:822-&gt;22/tcp   gitlab
  </code></pre>
  
  <p><code>sudo docker ps</code> after reboot:</p>
  
  <pre><code>CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS                   PORTS               NAMES
  2d2a062744ec        gitlab/gitlab-ce    "/assets/wrapper"   12 minutes ago      Up 2 minutes (healthy)                       gitlab
  </code></pre>