Docker hosts

Drop listed addresses before they reach published container ports, which UFW does not cover.

docker pull isipsafe/isipsafe:0.1.0

Docker publishes container ports with its own iptables rules, ahead of UFW and firewalld, so host firewall rules often do not protect containers at all. The DOCKER-USER chain is the place Docker leaves for your own rules: drop listed addresses there and they never reach a published port.

Set it up

1. Load the list into ipsets (creates isipsafe and isipsafe6), and repeat hourly from cron:

   curl -sf "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=ipset&confidenceMinimum=90" | sudo ipset restore

2. Drop them in DOCKER-USER, once:

   sudo iptables  -I DOCKER-USER -m set --match-set isipsafe  src -j DROP
   sudo ip6tables -I DOCKER-USER -m set --match-set isipsafe6 src -j DROP

3. Survive reboots. Docker recreates its chains on start but keeps whatever is in DOCKER-USER only until the next reboot. Run both steps from a systemd unit ordered After=docker.service, or with iptables-persistent and ipset-persistent, restoring the ipsets before the rules.

Check it works

sudo iptables -L DOCKER-USER -v -n     # packet counters on the DROP rule
sudo ipset list isipsafe | head

Rules in DOCKER-USER also apply to traffic between containers and the outside world in both directions, so a container calling out to a listed address is stopped too.

Behind a reverse proxy container (Traefik, Caddy, nginx), you can also report what it sees: see Traefik and Caddy.

Need a hand?

If something here does not work with your version of Docker hosts, or you have improved it, tell us. We update these pages with what people send.

Docker hosts and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.