run docker-daemon with --iptables false

Question

I want to set up a static firewall and network configuration, so that I can run docker-daemon with --iptables=false (i.e. not having Docker modifying the firewall), in a way that containers should not exposed to the external world, but it's still possible to have containers connected to services when using docker-compose

Answer 1

The docker network model uses iptables to set up internet connectivity for your containers. Only set iptables=false if you explicitly do not want your containers that are using bridge or overlay network drivers to have any network connectivity at all.

When you start the daemon with iptables=true, it will set up the required rules in your firewall. When docker shuts down, I don't believe it tears those rules down, so they stick around. This is why you get internet connectivity after starting docker back up with iptables=false. If you want to preserve those rules on the next docker startup after a reboot, the best way is to keep iptables=true.

Answer 2

I agree with @Kalgi, iptables=false is necessary to setup the firewall but also make sure docker shouldn't overrides the firewall configuration.