Internal network between containers without external network access

General
9

To create a network that doesn’t allow access to communicating with external networks, use the ‘internal: true’ configuration on an Overlay network. Your config would thus be:

version: "3"
services:

  proxy:
    build: ./proxy
    networks:
      - network2
      - network1

  app:
    build: ./app
    networks:
      - network1

networks:
  network1:
    driver: overlay
    internal: true
  network2:
    driver: custom-driver-2

Containers that are only on network1 won’t be able to communicate with the “outside” world. In your case, the app service won’t be able to access google.com but proxy will (since it’s also on a non-internal network).

1 Like