Post #2023252
2026-04-18 06:51 UTC
@jana Thanks for this - it took quite a bit to find where that's actually documented. https://docs.docker.com/engine/network/port-publishing/#gateway-modes
Seems like it might expose individual container IPs to the Internet though as outgoing traffic comes from those IPs.
Guess I can't have it both ways (I prefer everything to be behind a single reverse proxy)
Replies (1)
-
@jana@social.jsteuernagel.de 2026-04-18 07:38
@voltagex Yeah, exactly. With this it will work like any other, for example, VM solution would work, where every VM has its own v6 IP and uses that to talk to external services directly. So same thing here, as it should be with IPv6. Notably the feature to expose container ports still works perfectly, so by default the containers are not reachable from the outside, but if you expose a port via Docker, it will create a firewall rule to allow that ingress. And you can of course still use a reverse proxy as the single point of ingress. That's what I do in my setup. All containers have their own public v6 addresses, but they only allow incoming connections from the reverse proxy.