3

I am using docker to run a few server apps on a raspberryPi with ports exposed to the open internet. If an attacker were to successfully infiltrate my docker containers, I would like to be certain that they cannot access other devices on my network.

Therefore, I would like to know how to lock down my docker containers so that they can only send outbound traffic to each other (when necessary, and in some cases it is not) and to the internet, but not to other devices in my LAN.

If there is a better way to achieve my end goal, I am all ears for that, also.

5
  • does the raspberry pi have to be on the same LAN as you're other devices? In other words is it just the containers that need to be isolated but you want the pi's connectivity unchanged or doesn't it matter? Commented Feb 9, 2021 at 10:35
  • In this case, no, it does not need to be on the same LAN. I have considered putting it on a guest network, although with my router that would mean forcing it to use Wifi (unless I'm overlooking some settings somewhere)
    – caps
    Commented Feb 11, 2021 at 1:17
  • Does your router model have any mention of VLAN or DMZ functionality? SMB & 'prosumer' routers would have it but ISP issued ones would likely not or have the functionality removed from my experience Commented Feb 11, 2021 at 2:23
  • There's a DMZ "on/off" switch (I'm assuming config would appear if I enabled it) but I don't see anything about VLAN in the config page or even in the manual.
    – caps
    Commented Feb 12, 2021 at 17:17
  • Odd usually there'd be something in the UI or instructions about it. If you like I can have a quick squiz at the manual for you if you let me know the model. It might have been feature locked down if you were provided the router by ISP or MSP maybe. Commented Feb 14, 2021 at 20:34

3 Answers 3

2

I’d also recommend setting up a DMZ, and placing your whole Pi into this network zone.

Other than that you can check the networks which docker creates (there might be multiple depending on your container configuration / compose files) and check your iptables settings.

Beware that docker handles iptables and might overwrite some of your rules. But it might add another layer of security to create some rules on the raspberry pi to prevent communication from those networks to your homenetwork (maybe allow only connections to certain devices, ports)

Long story short:

  • you should really really configure a dmz for internet facing servers (or have a restrictive firewall on all your homedevices - not really doable with smarthome embedded devices)
  • check what your containers can do already - exec into them and try - maybe limit those container permissions to a minimum (if you create the containers yourself harden them - only minimal required stuff to run the service - no tool to install stuff, no root permissions, avoid network communication tools inside the container - you could also remove those tools by using public containers as a base image and clean them with a few commands instead of using public containers directly)
  • keep containers and the services inside up to date and keep an eye on security
  • maybe you implement some rolling lifecycle so an attacker inside the container gets removed and replaced by a fresh container after a period of time etc.

All in all you can to a lot to improve security and minimize the chance of an attack escalating into your network.

1
0

Isn't this the default case? There is a default bridge allowing containers to communicate with each other and you can create arbitrary numbers of bridges to constrain each docker container.

From the documentation:

In terms of Docker, a bridge network uses a software bridge which allows containers connected to the same bridge network to communicate, while providing isolation from containers which are not connected to that bridge network. The Docker bridge driver automatically installs rules in the host machine so that containers on different bridge networks cannot communicate directly with each other.

Also no upstream connectivity:

By default, traffic from containers connected to the default bridge network is not forwarded to the outside world. To enable forwarding, you need to change two settings. These are not Docker commands and they affect the Docker host’s kernel.

As for all security assertions, I would test to make sure it behaves as expected.

0

Rather than doing changes in the raspberryPi (maybe only the container was compromised perhaps the whole pi too), I would recommend configuring the router in such a way that the raspberryPi is in a dmz with no access to the other devices.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .