Answers: <p><code>icc=false</code> means that inter-container communications are not allowed. If you want to allow inter-container communications, you need to run your containers on a network without this setting.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-08-04T13:30:48.990Z
Answers: So, should I create one bridge per service ? And the reverse proxy is connected to all bridges ?
Answers: Guix555
Answers: CC BY-SA 4.0
Answers: 2022-08-04T13:44:20.553Z
Answers: @Guix555 that's a common design with reverse proxies. The other is to have services that don't talk to each other and you trust on the same network.
Answers: BMitch
Answers: CC BY-SA 4.0
Answers: 2022-08-04T14:05:56.757Z
Answers: Thanks @BMitch. This will quickly add several bridges. Is there a maximum ?
Answers: Guix555
Answers: CC BY-SA 4.0
Answers: 2022-08-04T14:20:24.213Z
Answers: @Guix555 I think most people run out of private subnet ranges before hitting any other limits. I'm not sure there's a hard limit in docker.
Answers: BMitch
Answers: CC BY-SA 4.0
Answers: 2022-09-30T13:38:25.657Z
Answers: Docker's default network pools allows for 31 custom bridge networks. The first 15 will be allocated from 172.168.17.0/12 as /16's - allowing ~65535 hosts each. the next 16 are allocated from the 192.168.0.0/16 block as /20's - allowing ~4095 hosts each. If/when swarmmode is activated, overlay networks are then allocated from 10.0.0.0/8 as /24s, allowing for just over 16 million networks, each with ~255 hosts.
Answers: Chris Becke
Answers: CC BY-SA 4.0
Answers: 2023-02-04T18:42:46.053Z
Answers: How do I prevent some containers from talking to each other while allowing others? I thought we could do this w/link.
Answers: Gary
Answers: CC BY-SA 4.0
Answers: 2023-02-04T20:39:24.767Z
Answers: Link adds an entry to /etc/hosts, it predates using DNS, and is considered a legacy feature. To ask a new question, please use the "ask question" button.
Answers: BMitch
Answers: CC BY-SA 4.0
Answers: 2022-08-04T12:34:12.100Z
Answers: 2022-08-04T12:34:12.100Z
Answers: BMitch
Body: <p>I'd like to connect several services with a reverse proxy. But the services can't communicate with each others.</p>
  <p>I'm using a compose file for each service.</p>
  <p>I'm trying to use the same external bridge (icc=false).</p>
  <p>After that, I don't understand how to allow the different communication with the reverse proxy. I've tried links and external_links but it doesn't work. Then, I have read that link will be deprecated...</p>
  <p>Sorry for my english, I'm not a native speaker.
  Thanks, have a good day.</p>
  <pre><code>#Example of Test1 compose file:
  version: '3'
  services:
    app:
      image: nicolaka/netshoot:latest
      tty: true
      restart: always
      networks:
        app-net:
      external_links:
        - test2-app-1
       
  networks:
    app-net:
      external:
        name: bridge_icc_false #created with com.docker.network.bridge.enable_icc=false
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2023-02-04T18:45:10.607Z
Comments: I thought link allowed containers to talk w/each other even when icc was set to false. Is there a way to do this?
Comments: Gary
Comments: CC BY-SA 4.0
Comments: 2023-02-06T07:43:22.587Z
Comments: I thought too. But link option is depracated. This is why I posted this question. I currently do BMitch's answer (see comments below).
Comments: Guix555
Tags: <docker><docker-compose><network>
Title: How to link containers in a "icc=false" bridge?
UserDisplayName: Guix555
ThreadText: # How to link containers in a "icc=false" bridge?
  
  (Asked by: username_0 on 2022-08-04)
  
  I'd like to connect several services with a reverse proxy. But the services can't communicate with each others.
  
  I'm using a compose file for each service.
  
  I'm trying to use the same external bridge (icc=false).
  
  After that, I don't understand how to allow the different communication with the reverse proxy. I've tried links and external\_links but it doesn't work. Then, I have read that link will be deprecated...
  
  Sorry for my english, I'm not a native speaker.
  Thanks, have a good day.
  
  ```
  #Example of Test1 compose file:
  version: '3'
  services:
    app:
      image: nicolaka/netshoot:latest
      tty: true
      restart: always
      networks:
        app-net:
      external_links:
        - test2-app-1
       
  networks:
    app-net:
      external:
        name: bridge_icc_false #created with com.docker.network.bridge.enable_icc=false
  
  ```
  
  **Tags:** docker, docker-compose, network
  
  > **Comments:**
  > **username_1**: I thought link allowed containers to talk w/each other even when icc was set to false. Is there a way to do this?  
  > **username_0**: I thought too. But link option is depracated. This is why I posted this question. I currently do username_2's answer (see comments below).  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2022-08-04. Score: 1 | Accepted answer
  
  `icc=false` means that inter-container communications are not allowed. If you want to allow inter-container communications, you need to run your containers on a network without this setting.
  
  > **Comments:**
  > **username_0**: So, should I create one bridge per service ? And the reverse proxy is connected to all bridges ?  
  > **username_2**: @username_0 that's a common design with reverse proxies. The other is to have services that don't talk to each other and you trust on the same network.  
  > **username_0**: Thanks @username_2. This will quickly add several bridges. Is there a maximum ?  
  > **username_2**: @username_0 I think most people run out of private subnet ranges before hitting any other limits. I'm not sure there's a hard limit in docker.  
  > **username_3**: Docker's default network pools allows for 31 custom bridge networks. The first 15 will be allocated from 172.168.17.0/12 as /16's - allowing ~65535 hosts each. the next 16 are allocated from the 192.168.0.0/16 block as /20's - allowing ~4095 hosts each. If/when swarmmode is activated, overlay networks are then allocated from 10.0.0.0/8 as /24s, allowing for just over 16 million networks, each with ~255 hosts.  
  > **username_1**: How do I prevent some containers from talking to each other while allowing others? I thought we could do this w/link.  
  > **username_2**: Link adds an entry to /etc/hosts, it predates using DNS, and is considered a legacy feature. To ask a new question, please use the "ask question" button.  
  
  ---
  
  