Docker Containers and Networks - Increase Security
reddit / selfhosted

----------------------------------------------------------------------
SEND_NUKES_PLS · 2023-09-30 20:08

So I got into self hosting about 6 months ago, so I'm still relatively
new to this.

Right now I'm running Docker with about 40 or so containers, they're
all connected to the bridge network and I have the Cloudflare Tunnel
container exposing them to the internet via Cloudflare.

I'm now trying to figure out the best method to further increase
security in case any of the containers get compromised. As I
understand since they're all connected to the same network now and can
talk to each other, this means if one of the containers gets
compromised, it could possibly be used to exploit others.

So do I just leave each container on its own separate network and only
connect the Cloudflare Tunnel container to each dedicated network? or
would they still be able to talk to each other through the CF Tunnel
container itself? I guess they could also try to compromise the CF
Tunnel itself via other compromised containers since it would have
access to all of the containers...or am I talking non sense. HELP!

Thanks!

​

----------------------------------------------------------------------
thekrautboy · 2023-09-30 20:17

cloudflare network
      - cloudflare tunnel
      - app 1 web
      - app 2 web

    app 1 network
      - app 1 web
      - app 1 database
      - app 1 cache

    app 2 network
      - app 2 web
      - app 2 database
      - app 2 cache
      - app 2 whatever

and so forth... basically you only attach those container to the CF
network that actually get exposed. If a stack consists of multiple
containers (web app, db, cache, whatever) then you dont attach the
database to CF for example, there is no need for that.