Make docker only use one specific NIC

Question

The Setup

I am running docker on Debian, on a single host. The host runs all kinds of different services for my home network, like monitoring software, home automation, log aggregation and so on.
I started out with only one physical network adapter attached to the system, and created a few containers. Later, I added a secondary NIC, the idea being to move all docker containers on eth1 while using eth0 for ssh access to the docker host only.

Version Information

• Debian 10 "Buster"
• Docker 20.10.0
• Kernel 4.19.0-13-amd64
• systemd 241-7~deb10u5 amd64
• storage driver overlay2

The Problem

Docker currently publishes all containers both on NICs, and I can't find a clean and simple way to limit exposing services on eth1 only. This is regardless of whether I use host, bridge or self-defined networks.

Things I've tried without success

• Docker's daemon.json - set "ip" option. This looks like the most obvious solution to me, but it doesn't seem to have an effect, after reboots and service restarts services are still available on both network interfaces. I even recreated a container from scratch after introducing the "ip" option, also had no effect. Currently, the config looks very simple:

{
   "ip" : "192.168.1.10",
   "graph": "/srv/docker"
}

Docker command line reference explaining what "ip" should do

Things I've looked into, but don't like as a solution

• Blocking access to eth0 on the firewall level, except p22. This would work but feels like a hack to me.
• Setting the fixed IP address on each container. I tried, and it does work, but I want to have this set as a default on the server level, rather than specifying it manually for each container. If the docker host IP would change, I'd have to manually edit it again for each container.

Ideas?

There must be a (probably simple) way to change the host network from 0.0.0.0 to eth1's specific IP address, but for the life of me I haven't been able to find out how.

Answer 1

I don't see reason to use host network for the container (host network = --net=host parameter for container). Why you don't use default container networking and then just publish ports on the correct IP with the advance publish port syntax (-p IP:host_port:container_port), e.g.:

-p <eth1-ip-address>:<host-app-port>:<container-app-port>

Doc: https://docs.docker.com/config/containers/container-networking/#published-ports

Of course you can use host network for the container = --net=host parameter for container, but then don't bind all interfaces from the app (0.0.0.0:<app-port>), just start app on the specific eth1 IP.