Our bare-metal virtual machines are behind a NAT for firewall and security, so basically each machine has a 192.168.x.x interface and connects to the internet via the gateway.

On machine Web we run our web stack, on machine FTP we have an FTB backup and on machine Job we have a Python + Redis stack which processes jobs from other machines.

For CI/CD we want to use Docker on machine Web. Machine Web requires access to FTP and Job machines. Other than using Host mode from the Docker Network configuration modes, which breaks network isolation, how else can we make the FTP and Job machines available to Docker containers? What's the best practice in this situation in the industry?

NAT'ing is very popular and I don't think we should change anything about that. Exposing machines to the internet would be worse than breaking network isolation in Docker. So in production environments on Google for example, how do they handle such a scenario?

I have Googled this a lot but results only show on the reverse aspect of my problem, which is exposing Docker port to host, or I find mostly questions and articles on accessing host's localhost from Docker containers.




  • Keep in mind NAT was never designed as a security feature, it is the firewall's job to restrict access. And if the FTP server hosts your backups, then it is one piece of equipment you don't want to expose too much. I do not have a complete overview of your network topology, but I believe you need to have solid firewall rules in place either way. You do not explain why "Machine Web requires access to FTP and Job machines". If for example the need is just about file sharing, then there may be light touch solutions, that do not entail breaking the isolation model.
    – Kate
    Commented Apr 18 at 15:10
  • Hello I see where you are coming from. The purpose of out NAT is to put everything behind a firewall, not that the NAT would make anything secure by itself. And basically the Web machine which runs NodeJS, has Cronjobs which will backup the databse and files to the FTP machine and the Job machine is a crawler which we need to send jobs to. @Kate
    – Shayan
    Commented Apr 18 at 15:32
  • Will you please elaborate on the "light touch solutions"?
    – Shayan
    Commented Apr 18 at 15:33
  • So the solution could be to share Docker volumes among multiple containers? In your internal network, FTP is probably not even needed. You could mount a volume just for your web machine, so that you don't expose the whole backup and reduce the attack surface.
    – Kate
    Commented Apr 18 at 15:44
  • No not Volumes, I simply need to make the IP of the FPT machine and Job machine accessible in Docker containers. @Kate
    – Shayan
    Commented Apr 18 at 16:38


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.