Is SSL/HTTPS Needed Between Docker Containers on the Same Network?

Question

As the title of the questions asks, is it important/needed to have ssl/https working between docker containers on the same network?

Our setup is an Nginx container that proxies two Tomcat containers.

The Nginx container performs ssl termination for the internet cloud.

Then the http request is forwarded to one of two tomcat instances in the same docker network.

For security/safety should the communication between the Nginx container and the two Tomcat containers happen over ssl?

Thank you for your time.

Answer 1

Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access where reverse proxy sits and bridges the gap into internal network).

A wider answer would primarily depend on whether you trust your Docker host and services on it. Then consider how containers address each other, do they need to leave docker network (like public name resolution) at any time. And what you'd be looking for from TLS: identity verification or transport encryption. Each of those considerations would have some caveats.

Answer 2

As security cannot be high enough, using SSL between containers can be implemented, but:

• eavesdropping on the traffic among containers is nearly impossible as your containers are isolated from other networks, so you are already protected
• HTTPS is slower to 4x-10x than HTTP
• and from an IT security perspective it is not worth the price and resources it would take to implement the eavesdropping in your system (except if you store the next week's winning lottery numbers there).

So in short, it is unnecessary.

Answer 3

It depends on the security stance of your project. If you're simply serving stickers to a chat app, then no, you probably don't need to encrypt data in transit.

But, if you're developing an application that runs in a bank, then generally the answer is yes, you must have tls between the service in a cluster. As another answer mentioned, there is a significant cost to this, so that cost must be weighed against the risk of doing nothing and the impact if it all goes horribly wrong.