> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/docker/docker-hardening-guide/docker-network-hardening.md). # Docker Network Hardening Docker creates a networking stack for container communication. By default, containers can communicate with all IP addresses. Use iptables rules to restrict this access. {% hint style="info" %} These instructions apply to Docker-based Python and PowerShell integrations and automations. For JavaScript integrations, set `js.http.restricted` to a comma-separated list of allowed IPs or hosts. {% endhint %} The default Docker network is `bridge` and its default interface is `docker0`. List Docker networks with `sudo docker network ls`. Inspect a network with `sudo docker network inspect `. | Key | Value | | -------------------- | ------------------------------------- | | `js.http.restricted` | `169.254.169.254,localhost,127.0.0.1` | ### Block network access to the host machine Integrations and automations usually do not need host-network access. Block access from containers to host services, including Cortex XSOAR Server. 1. Add an iptables rule for each private host IP address: ``` sudo iptables -I INPUT -s -d -j DROP ``` For Docker’s default `172.16.0.0/12` range, use: ``` sudo iptables -I INPUT -s 172.16.0.0/12 -d 10.18.18.246 -j DROP ``` If you configured another range in Docker’s `daemon.json`, use that range. You can also limit a specific source interface, such as `docker0`. 2. Block access to the Docker gateway IP: ``` iptables -I INPUT -i docker0 -d 172.17.0.1/32 -j DROP ``` 3. Optionally, list private host IP addresses: ``` sudo ifconfig -a ``` ### Block cloud instance metadata access Block containers from accessing the instance metadata service on `169.254.169.254`. ``` sudo iptables -I DOCKER-USER -i docker0 -d 169.254.169.254/32 -j DROP ``` On GCP, allow DNS queries to the metadata server when required: ``` iptables -I DOCKER-USER -i docker0 -d 169.254.169.254/32 -p udp --dport 53 -j ACCEPT ``` For metadata service details, see the [AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html) and [GCP documentation](https://cloud.google.com/compute/docs/metadata/overview). ### Assign a Docker network for an image Create a separate network for integrations that require metadata access. Most AWS integrations use the `demisto/boto3py3` image. 1. Create the network: ``` sudo docker network create -d bridge -o com.docker.network.bridge.name=docker-metadata aws-metadata ``` 2. Add the following server configuration: | Key | Value | | ----------------------------------------- | ------------------------ | | `python.pass.extra.keys.demisto/boto3py3` | `--network=aws-metadata` | 3. Reset running containers with `/reset_containers`. 4. Verify the network: ``` sudo docker network inspect aws-metadata ``` ### Block internal network access Block selected integrations from internal resources. This is recommended for the Rasterize integration when processing untrusted URLs or HTML. 1. Create an external Docker network: ``` sudo docker network create -d bridge -o com.docker.network.bridge.name=docker-external external ``` 2. Block host access: ``` iptables -I INPUT -i docker-external -d -j DROP ``` 3. Block metadata access: ``` sudo iptables -I DOCKER-USER -i docker-external -d 169.254.169.254/32 -j DROP ``` 4. Block internal address ranges: ``` sudo iptables -I DOCKER-USER -i docker-external -d 10.0.0.0/8 -j DROP sudo iptables -I DOCKER-USER -i docker-external -d 172.16.0.0/12 -j DROP sudo iptables -I DOCKER-USER -i docker-external -d 192.168.0.0/16 -j DROP ``` 5. Add the following server configuration: | Key | Value | | ----------------------------------------- | -------------------- | | `python.pass.extra.keys.demisto/chromium` | `--network=external` | 6. Reset running containers with `/reset_containers`. 7. Verify the network: ``` sudo docker network inspect external ``` ### Persist iptables rules iptables rules do not persist after a reboot. Save them using your operating system’s recommended configuration: * [Ubuntu](https://help.ubuntu.com/community/IptablesHowTo) * [Red Hat and related operating systems](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-setting_and_controlling_ip_sets_using_iptables) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-6-administrator-guide/6.12/onboard-cortex-xsoar/onboarding-in-cortex-xsoar/docker/docker-hardening-guide/docker-network-hardening.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.