In this exercise, you are a DevOps engineer tasked with isolating the MySQL database in a todo application. The frontend and backend are served from the same container and need to be publicly accessible, but the database must be isolated from both the public and the host machine.
You need to isolate the MySQL database by ensuring it is only accessible to the backend via a private Docker network. The backend and frontend will remain exposed to the public, but the database must not be reachable by the host machine or any external network.
Create Docker Networks:
Run the MySQL Database in the Private Network:
Expose the Combined Frontend and Backend:
Check Before Connecting Backend to the Public Network:
Verify Isolation:
todo-private
and todo-public
) must be created.MULTI-STAGE-BUILDS
. Use the same docker image that was created during Multi Stage Docker Image
exercise.Create Docker Networks: Use docker network create
to create two networks: todo-private
for internal communication and todo-public
for exposing the frontend/backend to the public.
Run MySQL on the Private Network: Run the MySQL container on the private network without exposing any ports to the host machine, ensuring it is isolated.
Run the Combined Backend and Frontend Container: First, run the backend and frontend container, exposing it to the private network, and verify that it is unreachable from the public network until you connect it to the public network.
Test the Setup: Before connecting the backend to the public network, try accessing it from a browser to verify it is isolated. Once verified, connect it to the public network and test that the frontend can access the backend and the backend can access the database.
Try to solve this exercise on your own before looking at the solution.
Create Docker Networks:
docker network create todo-private --internal
docker network create todo-public
Run the MySQL Database in the Private Network:
docker run --name mysql-todo --network todo-private -e MYSQL_ROOT_PASSWORD=root -e MYSQL_DATABASE=dockermastery -d mysql:latest
Run the Combined Backend/Frontend in the Private Network:
8080
:
docker run --name todo-app --network todo-private -e DB_URL=jdbc:mysql://mysql-todo:3306/dockermastery -e DB_USERNAME=root -e DB_PASSWORD=root -p 8080:8080 -d todo-app-multi-stage
Test Isolation Before Connecting to Public Network:
http://localhost:8080
—it should not load, verifying that the app is not accessible yet.Connect the Backend/Frontend to the Public Network:
docker network connect todo-public todo-app
http://localhost:8080
.Verify MySQL Isolation:
mysql -u root -p -h localhost -P 3306
This should fail because MySQL is not exposed to the host or public.By following these steps, you've successfully isolated the MySQL database using a private network while exposing the frontend and backend to the public. This setup ensures that only the backend can communicate with the database, and the database is protected from public or host access.
In real-world production environments, it's crucial to isolate critical services like databases from unauthorized access. Databases often contain sensitive information, and exposing them to the public or even the host machine can lead to serious security vulnerabilities.
In this exercise, we simulate how organizations manage network security by restricting access to services based on their roles. The backend service, which needs to interact with the database, is allowed access through a private network. However, the database is isolated from the public and host machine, ensuring that only the backend can communicate with it.
This kind of network segregation is common in large organizations to:
This exercise reflects these real-world practices, demonstrating the importance of protecting critical services while maintaining necessary communication between components.