如何实现用户自定义Docker网络中容器的对外通信与端口暴露？

Hey James, let's work through your Docker network issues one by one. I’ve dealt with similar setups before, so here’s a straightforward breakdown to get your system running exactly how you want:

First: Fixing the "can’t ping external machines" issue #

Your isolated_nw custom bridge network should handle external connectivity out of the box, but a few common hiccups might be blocking it. Let’s check these:

1. Verify container DNS settings #

Sometimes containers end up with wonky DNS configurations. Jump into your container and check the resolv.conf file:

docker exec -it 2d6 cat /etc/resolv.conf

If you don’t see a valid DNS server (like 8.8.8.8 or your host’s DNS), restart the container with an explicit DNS flag to fix it:

docker run --network isolated_nw --dns 8.8.8.8 -d [your-image-name]

This ensures the container can resolve external domains to IP addresses properly.

2. Check host firewall rules #

Docker adds its own iptables rules, but host firewalls (like ufw or firewalld) can sometimes override them. Test this by temporarily disabling your firewall:

# For ufw users
sudo ufw disable
# Now try pinging an external IP from the container
docker exec -it 2d6 ping 8.8.8.8

If it works, you’ll need to add rules to allow traffic between your host and the custom network. First get the subnet of isolated_nw:

docker network inspect isolated_nw | grep Subnet

Then allow traffic to/from that subnet:

sudo ufw allow in from [your-subnet]
sudo ufw allow out to [your-subnet]

Re-enable the firewall after adding these rules.

3. Reset Docker daemon config (if needed) #

If your Docker daemon has misconfigured network settings, it can break connectivity. Back up your current config and reset it to defaults:

sudo cp /etc/docker/daemon.json /etc/docker/daemon.json.bak
echo "{}" | sudo tee /etc/docker/daemon.json
sudo systemctl restart docker

This reverts to default network settings, which should fix any daemon-level issues blocking external access.

Second: Setting up restricted external access + internal outbound connectivity #

Your goal is clear: only one container’s specific port is reachable from outside, but all containers in isolated_nw can initiate connections to external networks. Here’s how to make that happen:

1. Ensure internal containers can reach external networks #

Once you fix the ping issue above, this part is automatic. Custom bridge networks use NAT to let containers send traffic out to the internet—no extra configuration needed.

2. Expose only the specific container’s port #

When you run the container that needs external access, use the -p flag to map its internal port to a host port. Skip this flag for all other containers in the network, and they won’t be reachable from outside:

# Example: Map container port 80 to host port 8080
docker run --network isolated_nw -p 8080:80 -d [your-specific-image]

Now external machines can access this container via [your-host-ip]:8080, while other containers in isolated_nw stay hidden from external traffic (but can still reach out to external networks themselves).

3. Extra strict isolation (optional) #

If you want to lock things down even more (to prevent accidental port mappings on other containers), you can add iptables rules to block all external traffic to the network except for your specific container’s port. First get the bridge ID of isolated_nw:

docker network inspect isolated_nw | grep Bridge

Then add these rules (replace placeholders with your actual values):

# Block all external traffic to the custom network
sudo iptables -I DOCKER-USER -i eth0 -o br-[your-bridge-id] -j DROP
# Allow traffic only to your specific container's port
sudo iptables -I DOCKER-USER -i eth0 -o br-[your-bridge-id] -d [container-ip] -p tcp --dport [container-port] -j ACCEPT

This adds a safety layer to ensure no other containers can be accessed externally, even if someone adds a port mapping by mistake.

Quick Recap #

1. Fix external connectivity by checking DNS, firewall rules, or resetting Docker config
2. Use -p only on the container that needs external access
3. (Optional) Add iptables rules for extra strict isolation

内容的提问来源于stack exchange，提问作者James