Body: <p>Our bare-metal virtual machines are behind a NAT for firewall and security, so basically each machine has a 192.168.x.x interface and connects to the internet via the gateway.</p>
  <p>On machine Web we run our web stack, on machine FTP we have an FTB backup and on machine Job we have a Python + Redis stack which processes jobs from other machines.</p>
  <p>For CI/CD we want to use Docker on machine Web. Machine Web requires access to FTP and Job machines. Other than using Host mode from the Docker Network configuration modes, which breaks network isolation, how else can we make the FTP and Job machines available to Docker containers? What's the best practice in this situation in the industry?</p>
  <p>NAT'ing is very popular and I don't think we should change anything about that. Exposing machines to the internet would be worse than breaking network isolation in Docker. So in production environments on Google for example, how do they handle such a scenario?</p>
  <p>I have Googled this a lot but results only show on the reverse aspect of my problem, which is exposing Docker port to host, or I find mostly questions and articles on accessing host's localhost from Docker containers.</p>
  <p><a href="https://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach">https://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach</a></p>
  <p><a href="https://stackoverflow.com/questions/17770902/forward-host-port-to-docker-container">https://stackoverflow.com/questions/17770902/forward-host-port-to-docker-container</a></p>
  <p><a href="https://docs.docker.com/network/network-tutorial-host/" rel="nofollow noreferrer">https://docs.docker.com/network/network-tutorial-host/</a></p>
  
Comments: CC BY-SA 4.0
Comments: 2024-04-18T15:10:50.940Z
Comments: Keep in mind NAT was never designed as a security feature, it is the firewall's job to restrict access. And if the FTP server hosts your backups, then it is one piece of equipment you don't want to expose too much. I do not have a complete overview of your network topology, but I believe you need to have solid firewall rules in place either way. You do not explain why "Machine Web requires access to FTP and Job machines". If for example the need is just about file sharing, then there may be light touch solutions, that do not entail breaking the isolation model.
Comments: Kate
Comments: CC BY-SA 4.0
Comments: 2024-04-18T15:32:45.287Z
Comments: Hello I see where you are coming from. The purpose of out NAT is to put everything behind a firewall, not that the NAT would make anything secure by itself. And basically the Web machine which runs NodeJS, has Cronjobs which will backup the databse and files to the FTP machine and the Job machine is a crawler which we need to send jobs to. @Kate
Comments: Shayan
Comments: CC BY-SA 4.0
Comments: 2024-04-18T15:33:10.790Z
Comments: Will you please elaborate on the "light touch solutions"?
Comments: Shayan
Comments: CC BY-SA 4.0
Comments: 2024-04-18T15:44:53.043Z
Comments: So the solution could be to share **Docker volumes** among multiple containers? In your internal network, FTP is probably not even needed. You could mount a volume just for your web machine, so that you don't expose the whole backup and reduce the attack surface.
Comments: Kate
Comments: CC BY-SA 4.0
Comments: 2024-04-18T16:38:42.883Z
Comments: No not Volumes, I simply need to make the IP of the FPT machine and Job machine accessible in Docker containers. @Kate
Comments: Shayan
Tags: <docker><docker-compose><networking><network>
Title: Best practice to share host NAT interface to Docker containers
UserDisplayName: Shayan
ThreadText: # Best practice to share host NAT interface to Docker containers
  
  (Asked by: username_0 on 2024-04-17)
  
  Our bare-metal virtual machines are behind a NAT for firewall and security, so basically each machine has a 192.168.x.x interface and connects to the internet via the gateway.
  
  On machine Web we run our web stack, on machine FTP we have an FTB backup and on machine Job we have a Python + Redis stack which processes jobs from other machines.
  
  For CI/CD we want to use Docker on machine Web. Machine Web requires access to FTP and Job machines. Other than using Host mode from the Docker Network configuration modes, which breaks network isolation, how else can we make the FTP and Job machines available to Docker containers? What's the best practice in this situation in the industry?
  
  NAT'ing is very popular and I don't think we should change anything about that. Exposing machines to the internet would be worse than breaking network isolation in Docker. So in production environments on Google for example, how do they handle such a scenario?
  
  I have Googled this a lot but results only show on the reverse aspect of my problem, which is exposing Docker port to host, or I find mostly questions and articles on accessing host's localhost from Docker containers.
  
  <https://stackoverflow.com/questions/24319662/from-inside-of-a-docker-container-how-do-i-connect-to-the-localhost-of-the-mach>
  
  <https://stackoverflow.com/questions/17770902/forward-host-port-to-docker-container>
  
  <https://docs.docker.com/network/network-tutorial-host/>
  
  **Tags:** docker, docker-compose, networking, network
  
  > **Comments:**
  > **username_1**: Keep in mind NAT was never designed as a security feature, it is the firewall's job to restrict access. And if the FTP server hosts your backups, then it is one piece of equipment you don't want to expose too much. I do not have a complete overview of your network topology, but I believe you need to have solid firewall rules in place either way. You do not explain why "Machine Web requires access to FTP and Job machines". If for example the need is just about file sharing, then there may be light touch solutions, that do not entail breaking the isolation model.  
  > **username_0**: Hello I see where you are coming from. The purpose of out NAT is to put everything behind a firewall, not that the NAT would make anything secure by itself. And basically the Web machine which runs NodeJS, has Cronjobs which will backup the databse and files to the FTP machine and the Job machine is a crawler which we need to send jobs to. @username_1  
  > **username_0**: Will you please elaborate on the "light touch solutions"?  
  > **username_1**: So the solution could be to share **Docker volumes** among multiple containers? In your internal network, FTP is probably not even needed. You could mount a volume just for your web machine, so that you don't expose the whole backup and reduce the attack surface.  
  > **username_0**: No not Volumes, I simply need to make the IP of the FPT machine and Job machine accessible in Docker containers. @username_1  
  
  ---
  
  ## 0 answers
  
  