Prevent remote access to docker containers

[Tib-z]

By default if a docker container has an exposed port it listens on 0.0.0.0:port. Is there an easy way to block remote access and limit to listen only on localhost / 127.0.0.1?
Direct access on a network might be a security issue.

[kdrag0n]

Standard Docker way: ❯ docker run -it --rm -p 127.0.0.1:8080:80 nginx

[Tib-z]

Yes, that's fine, tnx. However I was looking for a global setting (in orb or docker daemon) for default bind/listen ip to block remote access to containers. If you have a lot of projects with various docker-compose.yamls it would be nice to have a workaround insetad of changing each, one by one.

[kdrag0n]

Why not use the macOS firewall?

[Tib-z]

Good hint, I had a try but did not work as expected. At first when I enabled the firewall it seemed to work perfectly, remote access just timed out. Later on without changing any firewall settings the container was accessible. The firewall with docker is somewhat inconsistent. Then I just stumbled upon a still open issue from 2016 docker/for-mac#729 reporting that the firewall does not work with docker on mac.
Unfortunately macOS firewall is not an option.

[kdrag0n]

It works fine with OrbStack from my experience. Make sure you've disabled "Automatically allow downloaded signed software to receive incoming connections' and blocked "OrbStack Helper" in the firewall settings.