Security at the edge

Explicit access decisions. Private administration. Trusted proxy boundaries.

Keep administration deliberate

The admin server defaults to 127.0.0.1:9090. Inside Docker, binding to loopback prevents access through a published container port. If you deliberately enable external access, configure DR_ADMIN_BIND and set DR_ADMIN_USER and DR_ADMIN_PASS. Prefer a private network or an SSH forward.

environment:
  DR_ADMIN_BIND: "0.0.0.0"
  DR_ADMIN_USER: "admin"
  DR_ADMIN_PASS: "${DOCKROUTER_ADMIN_PASSWORD}"

Provide DOCKROUTER_ADMIN_PASSWORD through your deployment environment. Do not commit credentials to Compose files. A public admin port needs network-level protection too.

Trust forwarded IPs only from your proxies

Client IP filtering uses forwarded headers only for proxies listed in DR_TRUSTED_IPS. Without trusted proxy CIDRs it uses the peer address. Include only the networks of reverse proxies you operate or explicitly trust.

DR_TRUSTED_IPS=10.0.0.0/8
# Per-service labels:
dr.ipwhitelist: "192.168.0.0/16,10.0.0.0/8"
dr.ipblacklist: "192.168.100.1/32"

Set limits per service

Configure rate windows with dr.ratelimit, choose a rate-limit key with dr.ratelimit.by, and constrain request size with dr.maxbody.

dr.ratelimit: "100/m"
dr.ratelimit.by: "client_ip"
dr.maxbody: "10mb"

Define browser access

Use explicit CORS origins and methods for your application. These settings govern browser access; they do not replace authentication or authorization in the service.

dr.cors.origins: "https://app.example.com"
dr.cors.methods: "GET,POST,PUT,DELETE"