Restrict connectivity between specific containers

[rachit1arora]

Hello
I have requirement that i want to restrict network traffic on weave network and allow traffic only on certain ports lets say 80 , 443, 53 9010 etc.

What is the best way to restrict traffic on a non privileged container where i can not have iptable rules inside my docker conatiner . Can we restrict traffic on weave network from HOST machine.

If any one can provide pointers to control traffic on weave network would be helpful
Thanks in advance

[bboreham]

Hi, is the requirement to restrict traffic from one weave-attached container to another, or to restrict traffic from outside weave (when you have done a weave expose)

It sounds like you want the latter, but I wanted to check.

[rachit1arora]

Hello
We want to restrict traffic from one weave attached container to another

[bboreham]

Ah, ok, thanks for the clarification.

That isn't a feature we currently provide. Weave Net works almost entirely at Layer 2, so it doesn't examine TCP port numbers at all.

Can I ask what gives rise to this requirement? Typically we envisage Weave Net as a separate network just for your Docker containers, so you don't need to protect one from another.

[rachit1arora]

We have a cluster which consist of lets say 10 nodes(containers with weave ip attached) and each node is on a different host. Each node is a cluster has a defined role and we want one of these node in the cluster to be a shell node . where user can login over ssh and run some commands. So we want to restrict access from this shell container to other containers ie user should not be able to ssh on other containers in the cluster.

One Way we see this to achive is to set iptable rules in the shell container but that would mean running this container with more privileges like NET_ADMIN which we want to avoid.

[rade]

You should be able to apply some iptable rules on the shell container's host, restricting the container to talk to other containers on specific ports only.

Until #1577 is fixed that will likely only work when disabling fast data path.

[bboreham]

Noting that we have an implementation of Kubernetes NetworkPolicy, this issue is left open to cover a similar requirement for non-Kubernetes installs.