By Charles Joseph | Cybersecurity Researcher

 Published on March 30th, 2023

This post was updated on November 25th, 2023

Have you ever considered the implications of unrestricted internet access for your Docker containers? How secure is your data when your containers can freely access the internet? This article is all about that!

In this blog post, we’ll provide 3 strategies to restrict a Docker container’s internet access, ensuring a safer environment for your data and operations.

Method #1: Create an Isolated Network

To prevent a Docker container from having internet access, you can create a custom network without an external gateway, which will isolate the container from the host and the internet.

Here’s a step-by-step guide to create an isolated network and run a container without internet access:

1. Create a New Docker Network

docker network create --driver bridge isolated_network

This command creates a new Docker bridge network named isolated_network. By default, this network will not have an external gateway, so containers connected to it won’t have internet access.

2. Run the Container Using the New Network

docker run --network isolated_network --name my_container imagename

In this example, replace my_container with a custom name for your container and imagename with the name of the Docker image you want to run.

The container will be connected to the isolated_network and won’t have access to the internet.

3. Cleanup

When you’re finished with the container and the isolated network, you can remove them with the following commands:

docker rm my_container docker network rm isolated_network

Replace my_container with the actual name of your container.

These commands remove the container and the custom network you created.

Method #2: Network None

Another way to prevent a Docker container from having internet access is by using the --network none option when running the container.

This effectively isolates the container from any network, including the host and the internet.

Here’s how to run a container without network access:

docker run --network none --name my_container imagename

Replace my_container with a custom name for your container, and imagename with the name of the Docker image you want to run.

Please note that by using the --network none option, the container will be completely isolated and won’t be able to communicate with any other container, service, or the host system.

This level of isolation may cause the container’s functionality to be limited, so make sure to consider its requirements before applying this setting.

Method #3: Drop NET_RAW Using Capabilities

You can use Linux capabilities to prevent a Docker container from creating network connections.

By dropping the NET_RAW and NET_ADMIN capabilities, you can disable the container’s ability to use raw sockets and manage network interfaces, which effectively prevents it from initiating new network connections.

Here’s how to run a container with the NET_RAW and NET_ADMIN capabilities dropped:

docker run --cap-drop NET_RAW --cap-drop NET_ADMIN --name my_container imagename

Replace my_container with a custom name for your container, and imagename with the name of the Docker image you want to run.

Please note that dropping these capabilities might cause issues with some applications or services inside the container that rely on raw sockets or network management.

Make sure to test the container’s functionality and consider its requirements before applying these settings.

Keep in mind that this approach doesn’t completely isolate the container from the network or the internet.

It only limits the container’s ability to create new network connections.

Existing connections or incoming connections might still be allowed depending on the container’s configuration and the host system’s network settings.

Summary

Keep in mind that by preventing a container from having internet access, you might also limit its ability to communicate with other services it depends on, like package managers, APIs, or other containers in your infrastructure.

Make sure to consider the container’s functionality before applying this level of isolation.