The current setup is the following:
- A production server (host) has only a few open ports, namely HTTP, HTTPS and secure ports for e-mailing.
- On the host there is a non-privileged user running a Docker engine and containers.
- Several web applications are running on Docker containers, each runs on a virtual bridged network provided by the Docker runtime. They have open ports HTTP and HTTPS. Applications are running on arbitrary web-server technology, like Apache 2.? or AKKA-HTTP.
- Only one "http-proxy" container exposes its ports (80, 443) to the host. On this container, a non-privileged user is running a mod-secured Apache 2 server which only forwards requests based on the domain requested and forwards to one of the application containers.
- Mail server is running on a Docker container with non-privileged user that exposes its ports to the host.
Questions are:
- Are there any drawbacks to this model?
- How would it be more secure?
- How exposed are the application-containers to attacks?
- Are there any security considerations regarding Docker?
Thanks!