How to limit which container can see what containers?

[mks-h]

Hi. My setup is that I have a cloudflared container running in the same network as nginx, and therefore they can communicate with each other. But I also want to have other containers only visible to the nginx container, and not each other or cloudflared. Is there a way I can do this? I could imagine achieving this with multiple networks, but AFAIK I can only use one per container.

The idea is to minimize the misconfiguration/attack surface. The cloudflared container is used to expose the server to the Internet, and nginx is used as the webserver which is being exposed by cloudflared. Therefore they need to see each other. However, other containers do not need to be seen by cloudflared, so I would like to limit that. They also might not necessarily need to see each other, so I would like to limit that as well. Yet, they need to see nginx, as it exposes them under subdomains.

[rhatdan]

You can put a container into multiple networks.

https://www.redhat.com/sysadmin/podman-new-network-stack

[mks-h]

Thanks!