3 ms·
The article you linked to provides security for etcd. However, what is the standard approach for securing Docker container to container communication across ho
by akbar501 12y ago
The article you linked to provides security for etcd.
However, what is the standard approach for securing Docker container to container communication across hosts. For example from an app server to a DB server.
Is IPSec setup within CoreOS network layer, or is the security provided by Docker? If so, what are the options?
- michaelsbradley 12y agoI don't think CoreOS does anything special in this regard. It should be possible via cloud-config to change the runtime config of the docker service[1], in which case one could set "--icc=false"[2] to enforce stricter rules about inter-container communication on a particular docker host (e.g. a coreos droplet). [1] https://coreos.com/docs/launching-containers/building/customizing-docker/ https://coreos.com/docs/launching-containers/building/custom... [2] https://docs.docker.com/articles/networking/#between-containers https://docs.docker.com/articles/networking/#between-contain... EDIT: Okay, I see you were asking about regulating network comm between containers on separate docker hosts, i.e. coreos instances. That's a good question! I still don't think CoreOS addresses that concern in any special way at the level of iptables and routing (but I could be wrong). What it does give you is the ability to control service affinity with respect to your fleet "units". That way, you can be certain that docker containers which need to be "linked" in order to communicate properly (e.g. you have set "--icc=false") will run on the same host.