Hide Docker Containers Behind VPN

Question

I want to run all services within Docker containers (including RA and site-to-site VPN) such that all containers except the VPN are not exposed on the public IP, but are reachable on the VPN IP. This would mean an attacker would need to gain VPN access to know what was on the network, let alone attack anything. To the outside the server should appear to be running only a VPN server. I know that I can do this by embedding a VPN client inside each container, but I'd like to be able to use off-the-shelf containers and avoid the CPU+MEM overhead that would entail.

Answer 1

I think the most straightforward way to do this would be to use container linking. The exact solution depends on whether your containers that you want to access via this VPN are on different VMs / physical servers or not.

• If the containers are on the same server
  Essentially you would run your VPN server in it's own container, and link all the other service containers to it. You can then only expose the VPN port on the host machine, but once you are inside the VPN container you'll have access to the other services via docker's container linking private network magic.
• If the containers are on different servers
  Look into Linking docker containers across multiple hosts - this solution is a little more involved / complicated.

Answer 2

Approach the same concept as cloud servers, all server nodes are in private subnets and just build a NAT/VPN gateway to expose your services.

It's complicated to messing around with VPN and dockers just because you have to manually control the iptables rules on each node.