Docker Port Bindings with Internal Network Only

[Dectom]

I want to expose a port from a container to be accessible externally, However the container itself should only have access to the internal network and nothing more.

I had assumed this would be possible with Exposing the ports (8080:8080) and then applying the network.

Code looks as follows

/**
 * Build the Docker Container
 */
build(server) {
    return new Promise(async (resolve, reject) => {
        // Check that the image we are attempting to use for new containers actually exists
        await this.imageCheck(process.env.DOCKER_IMAGE ?? 'imagename:latest');
        
        let bindings = {};
        let exposed = {};
        
        // Return a random free port within range for us to use
        let port = await this.app.choosePort();
        // Define the port bindings and expose it
        bindings[`8080/tcp`] = [{HostPort: `${port}`}];
        exposed[`8080/tcp`] = {};

        logger.info("Building new Container", { server, port, path: `${process.env.APP_PATH}/data/${server.server_name}` });

        // Check that the internal network we are attempting to use for new containers actually exists 
        await this.networkCheck(process.env.NETWORK_NAME ?? 'no_internet');

        /**
         * Default Container Structure Object
         * 
         * This defines the Docker Container structure and required details...
         */
        const Container = {
            Image: process.env.DOCKER_IMAGE ? process.env.DOCKER_IMAGE : 'imagename:latest',
            name: server.server_name,
            Hostname: server.uuid,
            AttachStdin: true,
            AttachStdout: true,
            AttachStderr: true,
            OpenStdin: true,
            Tty: true,
            Cmd: [],
            ExposedPorts: exposed,
            HostConfig: {
                Mounts: [ // Mounts Here //],
                PortBindings: bindings,
                NetworkMode: process.env.NETWORK_NAME ?? 'no_internet',
                // Other Host Options Ommitted //
            }
        }

        // Send request to Docker Engine to Create the Container we have specified
        this.app.DockerController.createContainer(Container, (err, container) => {
            if(err) reject({err, port});
            return resolve({container, port});
        });
    });
}

Without the NetworkMode option set to the no_internet network then the container is created with the correct port bindings and has network access and functions as intended

If I specify the NetworkMode The container doesn't do any port bindings.

This is kinda important in the setup as Clients will have access to the container via the Port exposure, however we don't want them accessing the outer network through this just the internal network. Unless theres any alternative way of achieving this.

Without the no_internet Network

With the no_internet Network Applied

[xxAROX]

			this.container = await docker.createContainer({
				Tty: true,
				Image: "waterdogpe/waterdogpe:latest",
				name: "proxy",
				Hostname: "proxy",
				ExposedPorts: {
					["19132/udp"]: {}, // used container port
					["19132/tcp"]: {} // used container port
				},
				NetworkingConfig: {
					EndpointsConfig: {
						my_internal_net: {
							Aliases: ["waterdogpe"]
						}
					}
				},
				HostConfig: {
					PortBindings: {
						["19132/tcp"]: [{ HostPort: this.port+"/tcp" }], // this.port => is the outside port
						["19132/udp"]: [{ HostPort: this.port+"/udp" }] // this.port => is the outside port
					}
				}
			});

This is my code of binding the container to a host port. this.port in my case is 19131 and it works, i can connect to the proxy