0

As the title of the questions asks, is it important/needed to have ssl/https working between docker containers on the same network?

Our setup is an Nginx container that proxies two Tomcat containers.

The Nginx container performs ssl termination for the internet cloud.

Then the http request is forwarded to one of two tomcat instances in the same docker network.

For security/safety should the communication between the Nginx container and the two Tomcat containers happen over ssl?

Thank you for your time.

2

Generally - no, I don't think you need TLS between your reverse proxy and service containers within same Docker network (or possibly 2 Docker networks: 1 internal for workers, 1 with internet access where reverse proxy sits and bridges the gap into internal network).

A wider answer would primarily depend on whether you trust your Docker host and services on it. Then consider how containers address each other, do they need to leave docker network (like public name resolution) at any time. And what you'd be looking for from TLS: identity verification or transport encryption. Each of those considerations would have some caveats.

0

As security cannot be high enough, using SSL between containers can be implemented, but:

  • eavesdropping on the traffic among containers is nearly impossible as your containers are isolated from other networks, so you are already protected
  • HTTPS is slower to 4x-10x than HTTP
  • and from an IT security perspective it is not worth the price and resources it would take to implement the eavesdropping in your system (except if you store the next week's winning lotto numbers there).

So in short, it is unnecessary.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.