IP Bindings

[Zoey2936]

Could there maybe be an option to bind the ports of the containers to an IP, beside the manual docker-compose mode? So that the ports Nextcloud talk for example uses could at the same time for another service on another IP-address. (Maybe also the option to use different IPs per Nextcloud aio service/container/port)

[szaimen]

What would be the usecase for this?

[szaimen]

So basically why would you need port 3478 for another service on the same machine?

[Zoey2936]

For example:

1. I would like to bind nextcloud apache itself only to 127.0.0.1, since I don't need it to expose it to the internet, without using a firewall
2. I would like to run big blue button docker on the same machine, which has two public IP-Adresses, but changing in bbb docker the turn / stun ports is very complicated and does not work very well and as I think in Nextcloud aio not supported

[szaimen]

Honestly I see only a pretty limited usecase for ip bindings as you are already able to limit access using a firewall.

However allowing to change the talk port does make sense since that is currently not possible and would allow you to run it next to BBB.

[Zoey2936]

However allowing to change the talk port does make sense since that is currently not possible and would allow you to run it next to BBB.

This sounds good

Honestly I see only a pretty limited usecase for ip bindings as you are already able to limit access using a firewall.

The Problem I have is that I just get my Firewall to block requests to non docker ports, so I can block Ports of non-docker applications, but if I try to block a docker application it seems that docker ignores that rule, but I don't want to remove dockers access to the firewall, but yes I understand that just very few people would need such an option, but Thanks for making it possible to use bbb and nextcloud talk at the sametime using bbb docker and nextcloud aio

[Zoey2936]

I've finally got the firewall working to block only port 11000 using:
/sbin/iptables -I DOCKER-USER -p tcp --destination-port 11000 -i eth0 -j DROP
And saving this rule

[Zoey2936]

Just a small update on this, I changed my command, to:

# IPv4
iptables -A DOCKER-USER -p tcp -m tcp --dport 11000 -j DROP
# IPv6
ip6tables -A DOCKER-USER -p tcp -m tcp --dport 11000 -j DROP

Saving:

# IPv4
iptables-save > /etc/iptables/rules.v4
# IPv6
ip6tables-save > /etc/iptables/rules.v6

Requirements:
iptables & iptables-persistent
I don't know if it works on other OS, but on Debian 11 it works.

[szaimen]

Perfect! Thanks for the heads-up! :)

Will add this with #884 then!

[szaimen]

I will add this with #889

[szaimen]

This is now released with 1.6.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel

[Zoey2936]

I will test it at the end of the week, since I am currently on the baltical sea

[szaimen]

All right! Thanks for testing!
I've planned the stable release for 24.07 or later...

[Zoey2936]

This is now released with 1.6.0 Beta. Testing and feedback is welcome! See https://github.com/nextcloud/all-in-one#how-to-switch-the-channel

It works

[Zoey2936]

Thanks!