How to configure firewall for production docker host?

[orabig]

So, what about this topic ?
Has things changed since 2015 ? There are a bunch of open subjects about this issue.

Pulling docker images from behind whitelisted proxy

Docker Registry public IP addresses

Hello, There isn’t a published list of IPs that the official registry uses. They aren’t guaranteed to stay the same and aren’t guaranteed, unfortunately.

Running Docker With Outbound IP Firewalling

I am trying to deploy Docker inside a network with severe restrictions on outbound IP connectivity. The default is to deny all outbound IP traffic; trusted networks may be whitelisted one by one. I’ve whitelisted port 5000 + http + https on Docker’s IP range (162.242.195.64/26) and apt-get installed lxc-docker from the official Docker package repo. My first task is to install Docker Registry so we can have a private image repository. Following the instructions I write a config file and tell …

How to configure firewall for production docker host?

To use the public registry a docker pull creates multiple connections to different IPs (e.g. 162.242.195.84:443, 54.230..:443). What are the best practices regarding securing the docker host? This discussion is somewhat related to this post but currently without the need for setting up a private registry.

We are not all happy developpers with good buddies in the sec-team allowing a full internet access through their firewall. Several big companies do have severly resptricted firewalls for GOOD reasons, and we cannot use docker easily without any solution for this.

Of course, I’ve started to send access requests to .docker.com and .docker.io domains, but obviously it’s not enough…

Thanks for listening.