Implement Docker network security with custom bridge networks and container isolation

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m'

# Configuration variables
FRONTEND_SUBNET="172.20.1.0/24"
BACKEND_SUBNET="172.20.2.0/24"
DATABASE_SUBNET="172.20.3.0/24"
FRONTEND_GATEWAY="172.20.1.1"
BACKEND_GATEWAY="172.20.2.1"
DATABASE_GATEWAY="172.20.3.1"

# Usage function
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Options:"
    echo "  --cleanup     Remove Docker networks and iptables rules"
    echo "  --verify      Verify network configuration"
    echo "  --help        Show this help message"
    echo ""
    echo "Example: $0"
    echo "         $0 --cleanup"
    exit 1
}

# Logging functions
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
log_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function for trap
cleanup_on_error() {
    log_error "Script failed. Cleaning up partial configuration..."
    cleanup_networks 2>/dev/null || true
    exit 1
}

# Detect distribution and package manager
detect_distro() {
    if [ -f /etc/os-release ]; then
        . /etc/os-release
        case "$ID" in
            ubuntu|debian) 
                PKG_MGR="apt"
                PKG_INSTALL="apt install -y"
                PKG_UPDATE="apt update"
                IPTABLES_PERSISTENT_PKG="iptables-persistent"
                ;;
            almalinux|rocky|centos|rhel|ol|fedora) 
                PKG_MGR="dnf"
                PKG_INSTALL="dnf install -y"
                PKG_UPDATE="dnf check-update || true"
                IPTABLES_PERSISTENT_PKG="iptables-services"
                ;;
            amzn) 
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum check-update || true"
                IPTABLES_PERSISTENT_PKG="iptables-services"
                ;;
            *) 
                log_error "Unsupported distribution: $ID"
                exit 1
                ;;
        esac
    else
        log_error "Cannot detect distribution. /etc/os-release not found."
        exit 1
    fi
}

# Check if running as root or with sudo
check_privileges() {
    if [ "$EUID" -ne 0 ]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Function to check if Docker network exists
network_exists() {
    docker network ls --format "{{.Name}}" | grep -q "^$1$"
}

# Function to check if iptables rule exists
rule_exists() {
    iptables -C DOCKER-USER "$@" 2>/dev/null
}

# Function to add iptables rule if it doesn't exist
add_rule_if_not_exists() {
    if ! rule_exists "$@"; then
        iptables -I DOCKER-USER "$@"
        log_info "Added iptables rule: $*"
    else
        log_info "Rule already exists: $*"
    fi
}

# Install Docker and required packages
install_docker() {
    log_info "[1/7] Installing Docker and dependencies..."
    
    $PKG_UPDATE
    
    case "$PKG_MGR" in
        apt)
            $PKG_INSTALL docker.io docker-compose $IPTABLES_PERSISTENT_PKG
            ;;
        dnf|yum)
            $PKG_INSTALL docker docker-compose $IPTABLES_PERSISTENT_PKG
            ;;
    esac
    
    # Enable and start Docker service
    systemctl enable docker
    systemctl start docker
    
    # Add user to docker group if SUDO_USER is set
    if [ -n "${SUDO_USER:-}" ]; then
        usermod -aG docker "$SUDO_USER"
        log_warning "User $SUDO_USER added to docker group. Please log out and back in for changes to take effect."
    fi
    
    log_success "Docker installation completed"
}

# Create custom bridge networks
create_networks() {
    log_info "[2/7] Creating custom bridge networks..."
    
    # Create frontend network
    if ! network_exists "frontend-net"; then
        docker network create --driver bridge \
            --subnet="$FRONTEND_SUBNET" \
            --gateway="$FRONTEND_GATEWAY" \
            --opt com.docker.network.bridge.name=web-bridge \
            frontend-net
        log_success "Created frontend-net network"
    else
        log_info "frontend-net network already exists"
    fi
    
    # Create backend network
    if ! network_exists "backend-net"; then
        docker network create --driver bridge \
            --subnet="$BACKEND_SUBNET" \
            --gateway="$BACKEND_GATEWAY" \
            --opt com.docker.network.bridge.name=app-bridge \
            backend-net
        log_success "Created backend-net network"
    else
        log_info "backend-net network already exists"
    fi
    
    # Create database network with inter-container communication disabled
    if ! network_exists "database-net"; then
        docker network create --driver bridge \
            --subnet="$DATABASE_SUBNET" \
            --gateway="$DATABASE_GATEWAY" \
            --opt com.docker.network.bridge.name=db-bridge \
            --opt com.docker.network.bridge.enable_icc=false \
            database-net
        log_success "Created database-net network"
    else
        log_info "database-net network already exists"
    fi
}

# Configure network security policies
configure_iptables() {
    log_info "[3/7] Configuring network security policies..."
    
    # Ensure DOCKER-USER chain exists
    if ! iptables -L DOCKER-USER >/dev/null 2>&1; then
        iptables -N DOCKER-USER
        iptables -I FORWARD -j DOCKER-USER
    fi
    
    # Block inter-container communication on database network
    add_rule_if_not_exists -i db-bridge -o db-bridge -j DROP
    
    # Allow only backend network to access database network
    add_rule_if_not_exists -s "$BACKEND_SUBNET" -d "$DATABASE_SUBNET" -j ACCEPT
    
    # Allow only frontend to access backend on specific ports (8080)
    add_rule_if_not_exists -s "$FRONTEND_SUBNET" -d "$BACKEND_SUBNET" -p tcp --dport 8080 -j ACCEPT
    
    # Block direct frontend to database access
    add_rule_if_not_exists -s "$FRONTEND_SUBNET" -d "$DATABASE_SUBNET" -j DROP
    
    log_success "Network security policies configured"
}

# Create network policy enforcement script
create_policy_script() {
    log_info "[4/7] Creating network policy enforcement script..."
    
    cat > /usr/local/bin/docker-network-policy << 'EOF'
#!/usr/bin/env bash
# Docker Network Security Policy Script
set -euo pipefail

FRONTEND_SUBNET="172.20.1.0/24"
BACKEND_SUBNET="172.20.2.0/24"
DATABASE_SUBNET="172.20.3.0/24"

rule_exists() {
    iptables -C DOCKER-USER "$@" 2>/dev/null
}

add_rule_if_not_exists() {
    if ! rule_exists "$@"; then
        iptables -I DOCKER-USER "$@"
        echo "Added rule: $*"
    fi
}

echo "Applying Docker network security policies..."

# Ensure DOCKER-USER chain exists
if ! iptables -L DOCKER-USER >/dev/null 2>&1; then
    iptables -N DOCKER-USER
    iptables -I FORWARD -j DOCKER-USER
fi

# Apply security rules
add_rule_if_not_exists -i db-bridge -o db-bridge -j DROP
add_rule_if_not_exists -s "$BACKEND_SUBNET" -d "$DATABASE_SUBNET" -j ACCEPT
add_rule_if_not_exists -s "$FRONTEND_SUBNET" -d "$BACKEND_SUBNET" -p tcp --dport 8080 -j ACCEPT
add_rule_if_not_exists -s "$FRONTEND_SUBNET" -d "$DATABASE_SUBNET" -j DROP

echo "Network security policies applied successfully"
EOF
    
    chmod 755 /usr/local/bin/docker-network-policy
    chown root:root /usr/local/bin/docker-network-policy
    
    log_success "Network policy enforcement script created"
}

# Save iptables rules
save_iptables() {
    log_info "[5/7] Saving iptables rules..."
    
    case "$PKG_MGR" in
        apt)
            mkdir -p /etc/iptables
            iptables-save > /etc/iptables/rules.v4
            ;;
        dnf|yum)
            systemctl enable iptables
            service iptables save 2>/dev/null || iptables-save > /etc/sysconfig/iptables
            ;;
    esac
    
    log_success "iptables rules saved"
}

# Verify configuration
verify_configuration() {
    log_info "[6/7] Verifying configuration..."
    
    # Check Docker networks
    for network in frontend-net backend-net database-net; do
        if network_exists "$network"; then
            log_success "Network $network exists"
        else
            log_error "Network $network not found"
            return 1
        fi
    done
    
    # Check iptables rules
    if rule_exists -i db-bridge -o db-bridge -j DROP; then
        log_success "Database isolation rule active"
    else
        log_warning "Database isolation rule not found"
    fi
    
    # Check if policy script exists and is executable
    if [ -x /usr/local/bin/docker-network-policy ]; then
        log_success "Network policy script installed"
    else
        log_error "Network policy script not found or not executable"
        return 1
    fi
    
    log_success "Configuration verification completed"
}

# Cleanup function
cleanup_networks() {
    log_info "Cleaning up Docker networks and iptables rules..."
    
    # Remove custom networks
    for network in frontend-net backend-net database-net; do
        if network_exists "$network"; then
            docker network rm "$network" 2>/dev/null || true
            log_success "Removed network: $network"
        fi
    done
    
    # Remove iptables rules
    iptables -D DOCKER-USER -i db-bridge -o db-bridge -j DROP 2>/dev/null || true
    iptables -D DOCKER-USER -s "$BACKEND_SUBNET" -d "$DATABASE_SUBNET" -j ACCEPT 2>/dev/null || true
    iptables -D DOCKER-USER -s "$FRONTEND_SUBNET" -d "$BACKEND_SUBNET" -p tcp --dport 8080 -j ACCEPT 2>/dev/null || true
    iptables -D DOCKER-USER -s "$FRONTEND_SUBNET" -d "$DATABASE_SUBNET" -j DROP 2>/dev/null || true
    
    # Remove policy script
    rm -f /usr/local/bin/docker-network-policy
    
    log_success "Cleanup completed"
}

# Main function
main() {
    local cleanup_mode=false
    local verify_mode=false
    
    # Parse arguments
    while [[ $# -gt 0 ]]; do
        case $1 in
            --cleanup)
                cleanup_mode=true
                shift
                ;;
            --verify)
                verify_mode=true
                shift
                ;;
            --help)
                usage
                ;;
            *)
                log_error "Unknown option: $1"
                usage
                ;;
        esac
    done
    
    # Set up error handling
    trap cleanup_on_error ERR
    
    check_privileges
    detect_distro
    
    if [ "$cleanup_mode" = true ]; then
        cleanup_networks
        exit 0
    fi
    
    if [ "$verify_mode" = true ]; then
        verify_configuration
        exit 0
    fi
    
    # Main installation process
    log_info "Starting Docker network security implementation..."
    
    install_docker
    create_networks
    configure_iptables
    create_policy_script
    save_iptables
    verify_configuration
    
    log_success "[7/7] Docker network security implementation completed successfully!"
    log_info ""
    log_info "Networks created:"
    log_info "  - frontend-net ($FRONTEND_SUBNET)"
    log_info "  - backend-net ($BACKEND_SUBNET)"
    log_info "  - database-net ($DATABASE_SUBNET)"
    log_info ""
    log_info "Policy script available at: /usr/local/bin/docker-network-policy"
    log_info "Run '$0 --verify' to check configuration"
    log_info "Run '$0 --cleanup' to remove all networks and rules"
}

main "$@"