How to secure memcache

[amruthapbhat]

Hi,

We have a requirement where in we need to secure memcache. We tried building the docker file providing the memcache.conf file as per the below link

https://www.digitalocean.com/community/tutorials/how-to-install-and-secure-memcached-on-ubuntu-18-04

but when we do netstat -plunt inside the container it shows the below output
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
. . .
tcp 0 0 0.0.0.0:11211 0.0.0.0:* LISTEN 2279/memcached

Could you please let me know how i could restrict this running only within the service and not to the internet.

[wglambert]

Unless you specify a port mapping the container will only have connectivity to what is on its Docker network, so by default just itself.

To demonstrate; without a port mapping:

$ docker run -d --name memecache-no-portmap memcached
e2d9e78842902399dd4e33ca683670c90f3656d59183e8ed25ee563ff82e15b0

$ netstat -tulpn | grep 11211
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)

$ nmap localhost -p 11211

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-20 17:09 PDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000094s latency).

PORT      STATE  SERVICE
11211/tcp closed memcache

With a port mapping:

$ docker run -d -p 11211:11211 --name memecache-portmap memcached
d600be6e5d151b6d0646f849e6fd97ba342762ab9badb58b285d860ac3a77baa

$ sudo netstat -tulpn | grep 11211
tcp6       0      0 :::11211                :::*                    LISTEN      17016/docker-proxy

$ nmap localhost -p 11211

Starting Nmap 7.60 ( https://nmap.org ) at 2019-03-20 17:10 PDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000078s latency).

PORT      STATE SERVICE
11211/tcp open  memcache

Nmap done: 1 IP address (1 host up) scanned in 0.03 seconds

[tianon]

In the future, these sorts of questions/requests would be more appropriately posted to the Docker Community Forums, the Docker Community Slack, or Stack Overflow. Thanks!