I am currently involved in enhancing the security of a Docker-based web application.The application follows a traditional three-tier architecture, comprising a web app, an application layer, and a database—all operating on the same VM. A firewall and a WAF in reverse proxy are filtering the content before it reaches the Docker environment. However, inside the docker container we have no visibility over the traffic. I know that, from a classic secure architecture design, each level (web server, app server, database) should be separated and filtered by firewall and IPS. How is this strategy applying here? How can I gain visibility and does this model applies here anymore?

  • 1
    Have you read the documentation on Docker security?
    – vidarlo
    Jan 9 at 9:36
  • Visibility over the traffic is a bit old skool thinking? A tip on the side, the Center of Internet Security nowadays also offers hardened images for docker, might be interesting for you.cisecurity.org/insights/blog/…
    – Turdie
    Jan 9 at 12:29
  • "inside the docker container we have no visibility over the traffic" -- because there is no traffic if it is all on a single container. "each level ... should be separated and filtered by firewall and IPS" -- why? It sounds like you are trying to shoehorn one model's best practice when you aren't using that model. What risks do you want to mitigate? Start there.
    – schroeder
    Jan 9 at 13:58
  • Perhaps you want to put a new container in the same network and gather all the logs from the other containers or smth like that?.. Jan 9 at 19:57

1 Answer 1


So I'm assuming here that you're splitting the parts of your application into different containers (and orchestrating via compose?)

Generally speaking firewalling between containers, in a single host compose setup, isn't likely to be very useful, as your components are acting as a unit and generally there's only one service running in each container, so no management ports or similar to be firewalled off.

The "standard" advice to firewall between components of an application, when those components ran on different VMs (or physical hosts) was generally designed to stop an attacker who had compromised one host, getting to management or monitoring services on the other hosts. This is less relevant in a world where each container only runs one application service and nothing else.

For visibility, assuming standard Linux networking, your containers are running attached to a network bridge on the host, with each container running in its own network namespace, and you could attach a sniffer to those network namespaces if you wanted to.

However, it sounds like what you're looking for is the ability to observe activity in each container to detect possible malicious activity. Here you might be better served by a security agent which works with containers, something like Falco or Tetragon

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .