Answers: <p>Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access where reverse proxy sits and bridges the gap into internal network).</p>
  <p>A wider answer would primarily depend on whether you trust your Docker host and services on it. Then consider how containers address each other, do they need to leave docker network (like public name resolution) at any time. And what you'd be looking for from TLS: identity verification or transport encryption. Each of those considerations would have some caveats.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-01-21T10:00:01.283Z
Answers: 2021-01-21T10:00:01.283Z
Answers: apo
Answers: <p>As security cannot be high enough, using SSL between containers <em>can</em> be implemented, but:</p>
  <ul>
  <li>eavesdropping on the traffic among containers is nearly impossible as your containers are isolated from other networks, so you are already protected</li>
  <li>HTTPS is slower to 4x-10x than HTTP</li>
  <li>and from an IT security perspective it is not worth the price and resources it would take to implement the eavesdropping in your system (except if you store the next week's winning lottery numbers there).</li>
  </ul>
  <p>So in short, it is unnecessary.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-01-23T19:30:00.500Z
Answers: 2024-02-28T12:24:45.097Z
Answers: 2024-02-28T12:24:45.097Z
Answers: karatedog
Answers: <p>It depends on the security stance of your project. If you're simply serving stickers to a chat app, then no, you probably don't need to encrypt data in transit.</p>
  <p>But, if you're developing an application that runs in a bank, then generally the answer is yes, you must have tls between the service in a cluster. As another answer mentioned, there is a significant cost to this, so that cost must be weighed against the risk of doing nothing and the impact if it all goes horribly wrong.</p>
  
Answers: CC BY-SA 4.0
Answers: 2024-02-28T14:37:23.293Z
Answers: 2024-02-28T14:37:23.293Z
Answers: Software Engineer
Body: <p>As the title of the questions asks, is it important/needed to have ssl/https working between docker containers on the same network?</p>
  <p>Our setup is an Nginx container that proxies two Tomcat containers.</p>
  <p>The Nginx container performs ssl termination for the internet cloud.</p>
  <p>Then the http request is forwarded to one of two tomcat instances in the same docker network.</p>
  <p>For security/safety should the communication between the Nginx container and the two Tomcat containers happen over ssl?</p>
  <p>Thank you for your time.</p>
  
Tags: <docker><nginx><ssl><tomcat>
Title: Is SSL/HTTPS Needed Between Docker Containers on the Same Network?
UserDisplayName: hooknc
ThreadText: # Is SSL/HTTPS Needed Between Docker Containers on the Same Network?
  
  (Asked by: username_0 on 2021-01-20)
  
  As the title of the questions asks, is it important/needed to have ssl/https working between docker containers on the same network?
  
  Our setup is an Nginx container that proxies two Tomcat containers.
  
  The Nginx container performs ssl termination for the internet cloud.
  
  Then the http request is forwarded to one of two tomcat instances in the same docker network.
  
  For security/safety should the communication between the Nginx container and the two Tomcat containers happen over ssl?
  
  Thank you for your time.
  
  **Tags:** docker, nginx, ssl, tomcat
  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_1 on 2021-01-21. Score: 3
  
  Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access where reverse proxy sits and bridges the gap into internal network).
  
  A wider answer would primarily depend on whether you trust your Docker host and services on it. Then consider how containers address each other, do they need to leave docker network (like public name resolution) at any time. And what you'd be looking for from TLS: identity verification or transport encryption. Each of those considerations would have some caveats.
  
  
  ---
  
  ### Answer by username_2 on 2021-01-23. Score: 1
  
  As security cannot be high enough, using SSL between containers *can* be implemented, but:
  
  * eavesdropping on the traffic among containers is nearly impossible as your containers are isolated from other networks, so you are already protected
  * HTTPS is slower to 4x-10x than HTTP
  * and from an IT security perspective it is not worth the price and resources it would take to implement the eavesdropping in your system (except if you store the next week's winning lottery numbers there).
  
  So in short, it is unnecessary.
  
  
  ---
  
  ### Answer by username_3 on 2024-02-28. Score: 0
  
  It depends on the security stance of your project. If you're simply serving stickers to a chat app, then no, you probably don't need to encrypt data in transit.
  
  But, if you're developing an application that runs in a bank, then generally the answer is yes, you must have tls between the service in a cluster. As another answer mentioned, there is a significant cost to this, so that cost must be weighed against the risk of doing nothing and the impact if it all goes horribly wrong.
  
  
  ---
  
  