Make container accessible only from localhost

Question

I have Docker engine installed on Debian Jessie and I am running there container with nginx in it. My "run" command looks like this:

docker run -p 1234:80 -d -v /var/www/:/usr/share/nginx/html nginx:1.9

It works fine, problem is that now content of this container is accessible via http://{server_ip}:1234. I want to run multiple containers (domains) on this server so I want to setup reverse proxies for them.

How can I make sure that container will be only accessible via reverse proxy and not directly from IP:port? Eg.:

http://{server_ip}:1234  # not found, connection refused, etc...
http://localhost:1234  # works fine

//EDIT: Just to be clear - I am not asking how to setup reverse proxy, but how to run Docker container to be accessible only from localhost.

Answer 1

Well, solution is pretty simple, you just have to specify 127.0.0.1 when mapping port:

docker run -p 127.0.0.1:1234:80 -d -v /var/www/:/usr/share/nginx/html nginx:1.9

Answer 2

Specify the required host IP in the port mapping

docker run -p 127.0.0.1:1234:80 -d -v /var/www/:/usr/share/nginx/html nginx:1.9

If you are doing a reverse proxy, you might want to put them all on a user defined network along with your reverse proxy, then everything is in a container and accessible on their internal network.

docker network create net
docker run -d --net=web -v /var/www/:/usr/share/nginx/html nginx:1.9
docker run -d -p 80:80 --net=web haproxy