How to secure and lock down Docker web app

[jjcale]

I am going to run my nginx:stable-alpine web server in Docker, with DNAT port forwarding from my router and expose it to the Internet.
I would like to learn how to protect my lan environment from possible attackers, who can launch zero-days attacks on Nginx and take over the container.
The container will be run as follows:
docker run -d -p 32768:80 -p 32769:443 nginx:stable-alpine
And I want to close any outbound traffic from the container.
My first thought was that I would have to implement fw rules on Synology and ensure I have a have the right interface set up for the container (not bridge).
Any thoughts?
Tx

 

[Rusty]

Check this topic

Run docker container with no access to internet

Hi All, Synology Docker allows you to set 2 types of network interface drivers: bridge: an isolated network namespace。 host: the same network namespace with Docker host 。 At the moment i'm trying to run a docker and not alloying to connect to internet. I'm not sure if its enough to attach...

www.synoforum.com

Ip masquerade is the keyword here