I've spun up a web server that listens on port 8080 like this:

# docker run --rm -p 8080:8080 python:3.6 sh -c "cd tmp && python -m http.server 8080"

I want to dynamically adjust iptables rules from the host to restrict access to the container. I tried blocking a source IP address by adding rules to the INPUT and DOCKER-USER chains:

# iptables -A INPUT -p tcp --destination-port 8080 -s -j DROP
# iptables -A DOCKER-USER -p tcp --destination-port 8080 -s -j DROP

This did not work. I can still curl the container from that source IP.

For comparison, doing the same exercise but running python -m http.server 8080 directly on my host instead of a container works fine: the traffic is blocked.

How can I dynamically block traffic to service running in a container?

Specifically I want to restrict some source IPs from accessing some ports, but I do not know these beforehand.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.