Offline Mode

By default, Docker containers are connected to a network and can reach the outside world. Sometimes, however, you might want to force a container into offline mode for security reasons.

Some scenarios where you might remove network access from a container:

• Running untrusted third-party code.
• Building an e-learning platform where users execute arbitrary code on your machines.
• Quarantining a container you suspect has malicious software communicating over the internet.

Using --network none

The docker run command has a --network none flag that makes it so the container cannot communicate with the outside world. This is super useful for complete isolation.

Testing the Isolation

Let’s test this by running a container in offline mode and trying to ping Google.

docker run -d --network none docker/getting-started

Now, try running the ping command from inside the container with a timeout of 2 seconds (-W 2):

docker exec CONTAINER_ID ping google.com -W 2

If everything is working as intended, the program should hang for 2 seconds and then report an error message indicating that you don’t have internet access!