Restrict outbound traffic from containers

,
1

We’re looking for recommendations on how to limit egress from our production network.

My overall goal is bigger than that – I’d like our Rails app to operate with no direct outbound network access. Instead, I’d like all outbound network access to go through a program/filter/proxy/etc so I can limit which hosts it can communicate with.

Do you have a recommendation for this? I can dream up some ideas, but figured I’d also ask you.

2

The Aptible platform currently doesn’t provide a way to do this. I don’t know of any way to restrict outbound traffic from a container without access the container’s host which isn’t an option on Aptible so I’d love to hear your ideas.