Isolating Services with Docker Networks

In this exercise, you are a DevOps engineer tasked with isolating the MySQL database in a todo application. The frontend and backend are served from the same container and need to be publicly accessible, but the database must be isolated from both the public and the host machine.

Requirements

You need to isolate the MySQL database by ensuring it is only accessible to the backend via a private Docker network. The backend and frontend will remain exposed to the public, but the database must not be reachable by the host machine or any external network.

Detailed Requirements and Acceptance Criteria

1. Create Docker Networks:

   • Create two Docker networks:
     • todo-private: For internal communication between the backend and database.
     • todo-public: For exposing the backend/frontend to the public network.

2. Run the MySQL Database in the Private Network:

   • The MySQL database should only be accessible to the backend and not be reachable from the host machine or external networks.

3. Expose the Combined Frontend and Backend:

   • The frontend and backend will be served from the same container and should be publicly accessible.

4. Check Before Connecting Backend to the Public Network:

   • Ensure that before connecting the backend to the public network, the service is unreachable from the browser, showing proper isolation.

5. Verify Isolation:

   • Ensure that the MySQL database is not accessible from the public or host machine, only from the backend.

Acceptance Criteria

1. Docker Networks Created: Two networks (todo-private and todo-public) must be created.
2. MySQL Database Isolation: The MySQL database must only be accessible to the backend service.
3. Service Exposure: The combined frontend/backend must be accessible to users via public ports after connecting to the public network.
4. Functional Application: Users should be able to access the application and see todos fetched from the backend.

Resources

• Docker Networking Documentation
• Project Repository: Github Project Repository
  Branch: MULTI-STAGE-BUILDS. Use the same docker image that was created during Multi Stage Docker Image exercise.

Possible Ways to Implement

• Create Docker Networks: Use docker network create to create two networks: todo-private for internal communication and todo-public for exposing the frontend/backend to the public.

• Run MySQL on the Private Network: Run the MySQL container on the private network without exposing any ports to the host machine, ensuring it is isolated.

• Run the Combined Backend and Frontend Container: First, run the backend and frontend container, exposing it to the private network, and verify that it is unreachable from the public network until you connect it to the public network.

• Test the Setup: Before connecting the backend to the public network, try accessing it from a browser to verify it is isolated. Once verified, connect it to the public network and test that the frontend can access the backend and the backend can access the database.

Final Solution

Try to solve this exercise on your own before looking at the solution.

Step-by-Step Solution:

1. Create Docker Networks:

   • Create a private network for the backend and database:

     docker network create todo-private --internal
     

   • Create a public network for exposing the frontend/backend:

     docker network create todo-public
     

2. Run the MySQL Database in the Private Network:

   • Run the MySQL container in the private network without exposing any ports to the host:

     docker run --name mysql-todo --network todo-private -e MYSQL_ROOT_PASSWORD=root -e MYSQL_DATABASE=dockermastery -d mysql:latest
     

3. Run the Combined Backend/Frontend in the Private Network:

   • Start the combined backend/frontend container in the private network and expose it on port 8080:

     docker run --name todo-app --network todo-private -e DB_URL=jdbc:mysql://mysql-todo:3306/dockermastery -e DB_USERNAME=root -e DB_PASSWORD=root -p 8080:8080 -d todo-app-multi-stage
     

4. Test Isolation Before Connecting to Public Network:

   • At this point, the frontend/backend is running in the private network, but it should be inaccessible from the public. Open a browser and go to http://localhost:8080—it should not load, verifying that the app is not accessible yet.

5. Connect the Backend/Frontend to the Public Network:

   • Now, connect the backend/frontend container to the public network:

     docker network connect todo-public todo-app
     

   • After connecting, you should now be able to access the application from the browser at http://localhost:8080.

6. Verify MySQL Isolation:

   • The database should still be isolated from the public network and host machine. Test it by trying to access the database from the host, which should fail:

     mysql -u root -p -h localhost -P 3306
     

     This should fail because MySQL is not exposed to the host or public.

By following these steps, you've successfully isolated the MySQL database using a private network while exposing the frontend and backend to the public. This setup ensures that only the backend can communicate with the database, and the database is protected from public or host access.

---

In real-world production environments, it's crucial to isolate critical services like databases from unauthorized access. Databases often contain sensitive information, and exposing them to the public or even the host machine can lead to serious security vulnerabilities.

In this exercise, we simulate how organizations manage network security by restricting access to services based on their roles. The backend service, which needs to interact with the database, is allowed access through a private network. However, the database is isolated from the public and host machine, ensuring that only the backend can communicate with it.

This kind of network segregation is common in large organizations to:

1. Minimize Security Risks: By isolating the database, even if the frontend or public-facing services are compromised, the attacker cannot directly reach the database.
2. Control Access: Only trusted services, like the backend, are permitted to access the sensitive parts of the system.
3. Enhance Compliance: Many industries, such as finance or healthcare, require strict data access controls, and network isolation plays a key role in ensuring regulatory compliance.

This exercise reflects these real-world practices, demonstrating the importance of protecting critical services while maintaining necessary communication between components.