Better way to Proxy internal Docker Containers reddit / selfhosted ---------------------------------------------------------------------- Possible-Week-5815 · 2023-12-01 15:53 What is the recommended way to use NGINX with Docker containers or how do you map them? ​ Currently im joining all docker containers to the nginx network and using the internal port instead of exposing the port on the docker itself. Are there any security issues when using it this way? ---------------------------------------------------------------------- Simplixt · 2023-12-01 16:02 One compromised container could read the traffic of all others, as the communication between Nginx and containers is often via HTTP, etc. So separation is always a good idea. ---------------------------------------------------------------------- MisterBazz · 2023-12-01 16:05 Have separate network for each service each stack provides. Then, add those networks to your nginx network. ---------------------------------------------------------------------- warlock2397 · 2023-12-01 16:06 I would recommend you to create a separate docker network and run all your containers in that including Nginx proxy manager. Nginx can talk to other containers on the network using the hostname and you don't have to expose any ports on the machine to access the Web UI. This drastically reduces the attack surface imo and I don't find any downsides to this at the moment. Lastly using SSL certificates is key to securing the connection between the client and the host. ---------------------------------------------------------------------- ericesev · 2023-12-01 16:20 I generally try to avoid having unrelated containers talk to one another. Each application (consisting of one or more containers) is in its own Docker network. This includes my reverse proxy; it is in its own "proxy" network. When I want to expose a container to the proxy, I add it to a "frontend" network. This network has [enable\_icc](https://docs.docker .com/engine/reference/commandline/network_create/#bridge-driver- options) set to false. frontend: driver_opts: com.docker.network.bridge.enable_icc: "false" com.docker.network.bridge.name: "frontend" This prevents containers in the frontend network from communicating with one another. Then, on the host, I add a single firewall rule to allow the "proxy" network to communicate with the "frontend" network. iptables -A DOCKER-USER -i proxy -o frontend -j ACCEPT I find Traefik makes this easy, as it reads from Docker to automatically find the IP addresses of the containers. ---------------------------------------------------------------------- Suterusu_San · 2023-12-01 16:43 Probably not exactly what your looking for, but I've been using caprover which handles a lot of the networks and nginx stuff for you, including segregation onto different networks. ---------------------------------------------------------------------- tschloss · 2023-12-01 17:15 Why would most of you introduce a shared network? The standard setup when I install some 3rd party maintained application is: each application comes as one compose which includes required internal networking. The service just exposes the minimum to the outside, which usually is just a http port. So I can run a reverse proxy which proxy_passes to these ports. If the Nginx also runs in a container, either use another network driver or use another target schema: instead of localhost:8181 it will be 172.20.0.1:8181 for example, when the desired service runs in a docker bridge with subnet 172.20.0.0/16 or 24. ---------------------------------------------------------------------- z3roTO60 · 2023-12-01 19:32 This is going to be a complicated answer, but the best thing you can do for this is to switch to Traefik as a reverse proxy. It will forward the traffic, with everything including HTTPS, authentication… and will do it without a port binding to the host. Just takes a few extra lines in the docker compose file. The problem with this: setting up Traefik the first time is a massive pain in the ass with its learning curve. But it REALLY saves time later. I’ve got it running on three machines now and wouldn’t do it any other way ---------------------------------------------------------------------- Possible-Week-5815 · 2023-12-01 21:07 thats what i already got, f.e. the app compose: app: networks: - app_network - nginx_network and the nginx compose: nginx: networks: - nginx_network but the question is, would it make more sense to setup like this?: app: networks: - app_network ports: - 1234:8080 and nginx is setup to proxy pass to host:1234 ---------------------------------------------------------------------- he-tried-his-best · 2023-12-01 23:11 Do you ever think what’ll happen to your families internet access etc when you die? ---------------------------------------------------------------------- ericesev · 2023-12-01 23:18 Indeed. It's also what keeps me from hosting their email or passwords. For networking stuff, I fully expect they'll just replace the router (linux box) with some consumer device. ---------------------------------------------------------------------- G1zm0e · 2023-12-02 00:58 I switched a long time ago to Traefik and never looked back. ---------------------------------------------------------------------- MisterBazz · 2023-12-02 03:23 No, you don't add the app to the nginx network. You add the nginx container to the app's network. ---------------------------------------------------------------------- root_switch · 2023-12-02 04:30 This is the way, you then have 1 container (nginx) that has access to all networks but none of those networks have access to each other. ---------------------------------------------------------------------- Possible-Week-5815 · 2023-12-02 06:56 so i change it like this: App Compose: \`\`\` app: networks: - app1\_network \`\`\` and Nginx Compose: \`\`\` nginx: networks: - app1\_network - app2\_network - app3\_network \`\`\` do i understand right? ---------------------------------------------------------------------- MisterBazz · 2023-12-02 17:22 Correct ---------------------------------------------------------------------- Possible-Week-5815 · 2023-12-02 17:26 makes sense, thank you! just changed it on all containers.