From 9da81a16391edfcbda9c748dcd519fb3ebd765e5 Mon Sep 17 00:00:00 2001 From: Akihiko Odaki Date: Sun, 4 Feb 2018 02:44:22 +0900 Subject: [PATCH] Isolate internal services from external networks in Docker configuration (#6369) The database and Redis do not need external connections, so isolate them and prevent unauthorized access. --- docker-compose.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index cfe70c5e8f..aaa3a44782 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -4,6 +4,8 @@ services: db: restart: always image: postgres:9.6-alpine + networks: + - internal_network ### Uncomment to enable DB persistance # volumes: # - ./postgres:/var/lib/postgresql/data @@ -11,6 +13,8 @@ services: redis: restart: always image: redis:4.0-alpine + networks: + - internal_network ### Uncomment to enable REDIS persistance # volumes: # - ./redis:/data @@ -21,6 +25,9 @@ services: restart: always env_file: .env.production command: bundle exec rails s -p 3000 -b '0.0.0.0' + networks: + - external_network + - internal_network ports: - "3000:3000" depends_on: @@ -37,6 +44,9 @@ services: restart: always env_file: .env.production command: npm run start + networks: + - external_network + - internal_network ports: - "4000:4000" depends_on: @@ -52,6 +62,14 @@ services: depends_on: - db - redis + networks: + - external_network + - internal_network volumes: - ./public/packs:/mastodon/public/packs - ./public/system:/mastodon/public/system + +networks: + external_network: + internal_network: + internal: true