Secure method to make mosquitto available on the host system?

[DrMichael]

Hi,

I want to access mosquitto from another docker container on the host system? But I do not want to expose mosquitto to the outside.

Or, alternatively, secure mosquitto with a login. So far, I secured mosquitto as of this. And used MQTT_USER and MQTT_PASSWORD in the docker-compose.yml.

Any ideas?

Michael

[LelandSindt]

My docker-compose is a little rusty... but if I remember correctly, the ports section will expose the listed ports on all interfaces on the host. (read: to the outside)

    ports:
      - "1883:1883"

If you want the mosquitto service to be available only to other containers in docker, You will need to omit the ports config and instead use docker networks and service name resolution to communicate.

I would start here: https://docs.docker.com/compose/networking/

... if you will allow me to be pedantic, requiring a username and password without also implementing encryption is not secure.

[adriankumpf]

Not a solution to the original question, but you can also bind to localhost as this guide suggests:

  ports:
      - 127.0.0.1:1883:1883

To share networks between containers you can use an external network, for instance:

services:
  teslamate:
    networks:
      mqtt:



  mqtt:
    external:
      name: mosquitto_mqtt

[DrMichael]

Not a solution to the original question, but you can also bind to localhost as this guide suggests:

  ports:
      - 127.0.0.1:1883:1883

Yes, I had limited success to put the other service into the teslamate docker-compose.yml with that (and connect to the host mosquitto). But ran into rather strange instabilities, probably caused by resource constraints.