[block access to docker container] block access to a specific docker container #docker #iptables #bash

iptables_block_accessing_container.sh

#!/usr/bin/env bash

# BLOCK ACCESS TO CONTAINER: manipulates existing rule by replacing it
CONTAINER='pricing-service'

# prep:
IP_ADDRESS=$(docker inspect --format='{{range .NetworkSettings.Networks}}{{print .IPAddress}}{{end}}' $(docker ps | awk -v service="$CONTAINER" '$0~service{print $1}'))
RULE="$(iptables --list DOCKER --line-numbers -n|awk -v address="$IP_ADDRESS" '$0~address{print $1}')"

# to block:
iptables -R DOCKER ${RULE} -d ${IP_ADDRESS}/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j DROP

# to unblock:
iptables -R DOCKER ${RULE} -d ${IP_ADDRESS}/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT