isolate stacks with docker network
reddit / selfhosted

----------------------------------------------------------------------
black-backdoor · 2023-12-12 09:35

To provide context, I aim to implement Docker networks for effectively
isolating my Docker stacks. As an illustration, consider a scenario
where I have a PHPMyAdmin container and a MySQL database container.
The  objective is to establish communication specifically between
PHPMyAdmin  and MySQL, while preventing interaction with other Docker
stacks.  Additionally, as I utilize Cloudflare tunnels to securely
expose my  containers to the internet, it is crucial for the
Cloudflare container  to have access to them as well.

----------------------------------------------------------------------
7WuCF77S95mfQFvfwk7F · 2023-12-12 10:51

I'm not sure if I understand what you want to do.

Do you want to limit access to your docker stack from the outside?

Then don't expose any ports you don't need to the outside of the
docker stack. The containers inside the stack will still be able to
communicate.

Do you want to route all traffic through one container, so one
container acts like a proxy? Bind the network of the other containers
to the network of the proxy.

    version: "x"
    services:
      docker_a:

      docker_b:
        network_mode: service:docker_a

----------------------------------------------------------------------
thekrautboy · 2023-12-12 12:51

> Does anyone know a good solution to my problem?

Uhm yes, use Docker networks. What is your exact problem?

Try /r/Docker for Docker specific questions and support.

----------------------------------------------------------------------
Spuxilet · 2023-12-12 20:26

I have good solution for you :)

Put PHPMyAdmin container and a MySQL database in one stack in one
network. example php\_mysql\_network

Then put cloudflare in that network too. Do this for other stacks
similarly. Have different network for each stack and put cloudflare in
all those networks. That's it.

I do exactltly that but i do not use cloudflare i put traefik in all
those networks and i use traefik for reverse proxy.

I suggest you to create networks manually, because if you turn off
that php and mysql stack in portainer it will remove that network and
cloudflare will through error that network does not exist. I have all
networks created manually and have small bash script for it if i want
to restore my configuration somewhere else or after disaster.

----------------------------------------------------------------------
lilolalu · 2023-12-12 22:29

What you are describing is the default behaviour of docker. If you
don't define custom networks that span several stacks or containers,
they are automatically "isolated".

----------------------------------------------------------------------
Spuxilet · 2023-12-12 22:34

He must put cloudflare container in all those networks to have access
to those services, but if he won't define custom networks then he will
have to start all those services first and then start cloudflare.

----------------------------------------------------------------------
lilolalu · 2023-12-12 22:39

Traefik?

----------------------------------------------------------------------
Spuxilet · 2023-12-12 22:41

I do not exactly know how you use cloudflare container, i myself have
traefik and wireguard server. But yes to have access to all those
services you will have to have one container that has access to all
those networks.

----------------------------------------------------------------------
lilolalu · 2023-12-12 22:44

No, you can just put a proxy server in front and server the port
that's supposed to be exposed or tunnel it with cloudflare or whatnot.
The proxy server does not need access to the stacks internal network.

----------------------------------------------------------------------
Spuxilet · 2023-12-12 22:48

That way you will have tons of ports exposed on machine. I was
describing my setup. On my homelab i do not have exposed any ports
other then wireguard port. Just one port and everything is accessible
through wireguard and traefik.

----------------------------------------------------------------------
lilolalu · 2023-12-12 22:49

I am even running HAProxy on a different machine (firewall) than my
docker host (homeserver) so it definitely can not access the internal
docker networks. That same setup is possible on a single machine as
well.

----------------------------------------------------------------------
lilolalu · 2023-12-12 22:52

I have a lot of ports exposed, towards the firewall. On the firewall I
have wireguard, HAproxy, and local DNS towards so I can expose these
ports

1. To the internet

Or

2. To the internal net

Or

3. To the VPN

However I please.

----------------------------------------------------------------------
black-backdoor · 2023-12-13 12:34

thanks