I've spun up a web server that listens on port 8080 like this:

# docker run --rm -p 8080:8080 python:3.6 sh -c "cd tmp && python -m http.server 8080"

I want to dynamically adjust iptables rules from the host to restrict access to the container. I tried blocking a source IP address by adding rules to the INPUT and DOCKER-USER chains:

# iptables -A INPUT -p tcp --destination-port 8080 -s -j DROP
# iptables -A DOCKER-USER -p tcp --destination-port 8080 -s -j DROP

This did not work. I can still curl the container from that source IP.

For comparison, doing the same exercise but running python -m http.server 8080 directly on my host instead of a container works fine: the traffic is blocked.

How can I dynamically block traffic to service running in a container?

Specifically I want to restrict some source IPs from accessing some ports, but I do not know these beforehand.

  • Thank you for posting a question. Could you modify the question so that it contains the attempts you have done in order to solve the issue? – 030 Dec 23 '19 at 10:26

Browse other questions tagged or ask your own question.