Docker Network Isolation Guide (Personal Reference)

README.md

Docker Subnet Isolation Guide (Unraid/Linux)

Purpose

Mainly just taking these notes down for my own future reference. Hope it helps some others out. For my use case I wanted to isolate a github runner so it couldn't access my home network but still had a clear path out to the greater internet. Protects against supply chain related vectors in case the runner is ever compromised.

1. Create Custom Docker Network

First, assign a dedicated subnet (e.g., 192.168.90.0/24) to prevent local network overlap.

docker network create -d bridge --subnet=192.168.90.0/24 isolated_bridge

2. Apply iptables Rules

Insert rules into the host FORWARD chain. Order matters: allow the container gateway first, then drop target LANs.

# Drop access to local subnets
iptables -A FORWARD -s 192.168.90.0/24 -d 192.168.1.0/24 -j DROP
iptables -A FORWARD -s 192.168.90.0/24 -d 192.168.11.0/24 -j DROP

Optionally, if you're wanting to allow traffic between two specific containers you can do an accept rule so containers on the isolated network can communicate

# Whitelist paths between containers that will coordinate with each other
iptables -I FORWARD -s 192.168.90.42 -d 192.168.90.69 -j ACCEPT
iptables -I FORWARD -s 192.168.90.69 -d 192.168.90.42 -j ACCEPT

Unraid Persistence

Add rules to /boot/config/go which runs at startup. The docker network will persist but the iptables will not.

Linux Persistence

Use iptables-persistent (sudo netfilter-persistent save).

3. Deploy Container

Attach the container to the custom network and force public DNS to bypass local resolvers.

CLI Example:

docker run -d --name=untrusted --network=isolated_bridge --dns=1.1.1.1 --dns=8.8.8.8 nginx:latest

Docker Compose Example:

services:
  untrusted:
    image: nginx:latest
    networks:
      - isolated_network
    dns:
      - 1.1.1.1
      - 8.8.8.8

networks:
  isolated_network:
    external: true
    name: isolated_bridge

Unraid Notes

When making the contianer, set Network Type to Custom: isolated_bridge. Add --dns=1.1.1.1 --dns=8.8.8.8 to Extra Parameters for extra protection from local network host enumeration in case the upstream dns for your docker installation is pointed to your home network's DNS provider..

4. Verify Isolation

Exec into the container (docker exec -it <name> sh) and test connectivity:

ping -c 3 google.com        # WAN Test: Should succeed
nslookup github.com         # DNS Test: Should succeed
ping -c 3 192.168.11.50     # LAN Block Test: Should hang/timeout