Container network security

1. How containers communicate #

Basic networking.

Model #

• Docker: per-host bridge networks (isolation by named network), overlay networks between Swarm hosts.
• Kubernetes: each pod has an IP, all pods can reach each other by default; the CNI (Calico, Cilium, Flannel) implements this network.
• Services provide a stable address; Ingress or the Gateway API expose to the outside.

Common mistake: By default, Kubernetes isolates nothing: a compromised pod can reach every database in the cluster. The first measure is a default-deny policy.

2. The measures #

Layer by layer.

NetworkPolicies #

# Refus par défaut dans le namespace, puis ouverture explicite
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: default-deny, namespace: shop }
spec: { podSelector: {}, policyTypes: [Ingress, Egress] }
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata: { name: api-to-db, namespace: shop }
spec:
  podSelector: { matchLabels: { app: postgres } }
  ingress:
    - from: [ { podSelector: { matchLabels: { app: api } } } ]
      ports: [ { port: 5432 } ]

Good to know: NetworkPolicies only apply if the CNI implements them (Calico, Cilium yes; Flannel alone no). Remember to allow DNS (port 53 to kube-dns) in egress rules.

Other layers #