Module 10 Lesson 5: Securing Container Comms

In a standard Docker network, every container can talk to every other container. This is bad. If an attacker hacks your "Public" web server, they can easily explore and attack your "Private" database. This is called Lateral Movement.

1. Network Segmentation (The "Locked Door" Strategy)

Don't put everything on the same network.

• Frontend Network: Only includes the Load Balancer and the Web App.
• Backend Network: Only includes the Web App and the Database.

Result: The Load Balancer cannot talk to the Database. If the Load Balancer is hacked, the DB is still safe.

---

2. Using the internal Flag

You can create a network that has No Internet Access.

docker network create --internal private-net

Containers on this network can talk to each other, but they cannot "Call home" to the internet. This is a perfect place for sensitive databases.

---

3. Inter-Container Encryption (TLS)

By default, Docker network traffic is Plain Text.

• The Threat: A hacker who gains access to the host or a neighboring container can "Sniff" your database passwords as they travel across the network.
• The Fix: Use TLS (SSL) for every connection, even internal ones. Connect to your database using sslmode=require.

---

4. IP Filter (The --icc=false Flag)

On Linux, you can tell the Docker Daemon to disable all Inter-Container Communication (ICC) by default.

• With icc=false, containers cannot talk to each other unless you explicitly link them or put them on the same user-defined network.
• (This is for advanced users managing their own Docker Engine).

---

Exercise: The Security Barrier

1. Write a docker-compose.yml with three services: mall (Web), vault (DB), and attacker (Shell).
2. Set it up such that mall can see vault, but attacker cannot see vault.
3. Launch the stack.
4. exec into attacker. Try to ping vault.
5. Why is this simple configuration more effective than a complicated firewall?
6. Research: What is a "Service Mesh" (like Istio or Linkerd) and how does it help with container encryption?

---

Conclusion of Module 10

You have mastered Docker Networking. You know how to choose the right drivers, map ports securely, use DNS for discovery, and implement "Defense in Depth" to protect your traffic.

Next Module: Moving to production: Module 11: Docker in Production (Registries and CI/CD).