I've spun up a web server that listens on port
8080 like this:
# docker run --rm -p 8080:8080 python:3.6 sh -c "cd tmp && python -m http.server 8080"
I want to dynamically adjust
iptables rules from the host to restrict access to the container. I tried blocking a source IP address by adding rules to the
# iptables -A INPUT -p tcp --destination-port 8080 -s 220.127.116.11 -j DROP # iptables -A DOCKER-USER -p tcp --destination-port 8080 -s 18.104.22.168 -j DROP
This did not work. I can still
curl the container from that source IP.
For comparison, doing the same exercise but running
python -m http.server 8080 directly on my host instead of a container works fine: the traffic is blocked.
How can I dynamically block traffic to service running in a container?
Specifically I want to restrict some source IPs from accessing some ports, but I do not know these beforehand.