ruby-on-rails - 使 Redis 服务器在 Digital Ocean 上安全

Question

我正在使用 redis container对于我的 Ruby on Rails 应用程序。我的应用程序部署在 Digital Ocean 服务器上。我收到一封电子邮件，说我的 Redis 配置不安全，因为 Redis 服务器命令在 redis-server *:6379 而不是 127.0.0.1:6379 上运行，这使得我的 Redis服务器不安全。

如何为 Redis 配置我的 Droplet 以使其在 127.0.0.1:6379 上运行？

以下是我为redis配置的docker-compose.yml:

app:
  build: .
  env_file: .env.production
  environment:
    RAILS_ENV: production
    REDIS_URL: redis://redis:6379/0
  links:
    - db
    - redis
  expose:
    - "3000"
  volumes:
    - .:/usr/src/app
db:
  image: postgres:9.4.5
  volumes:
     - project-postgres:/var/lib/postgresql/data
web:
  build: .
  dockerfile: config/containers/Dockerfile-nginx
  links:
    - app
    - redis
  environment:
    REDIS_URL: redis://redis:6379/0

  # expose the port we configured Nginx to bind to
  ports:
    - "80:80"
elasticsearch:
  #elasticsearch image
  image: elasticsearch
  container_name: elasticsearch
  # expose the port both ports
  ports:
    - '9200:9200'
    - '9300:9300'
  volumes:
     - /data/elasticsearch:/usr/share/elasticsearch/data
  environment:
    ES_JAVA_OPTS: -Xms256m -Xmx256m

redis:
  image: redis:latest
  command: redis-server

  ports:
    - '6379:6379'
  volumes:
    - 'redis:/var/lib/redis/data'

sidekiq:
  build: .
  command: bundle exec sidekiq
  links:
    - db
    - redis
  volumes:
    - .:/app
  env_file:
    - .env

Answer 1

    app:
      build: .
      env_file: .env.production
      environment:
        RAILS_ENV: production
        REDIS_URL: redis://redis:6379/0
      links:
        - db
        - redis
      expose:
        - "3000"
      volumes:
        - .:/usr/src/app
    db:
      image: postgres:9.4.5
      volumes:
        - project-postgres:/var/lib/postgresql/data
    web:
      build: .
      dockerfile: config/containers/Dockerfile-nginx
      links:
        - app
        - redis
      environment:
        REDIS_URL: redis://redis:6379/0

      # expose the port we configured Nginx to bind to
      ports:
        - "80:80"
    elasticsearch:
      #elasticsearch image
      image: elasticsearch
      container_name: elasticsearch
      # expose the port both ports
      # I don't know why you want to expose this to the world.
      # I also think you should take away the ports here and link
      # the container which you want to interact with Elasticsearch 

      volumes:
        - /data/elasticsearch:/usr/share/elasticsearch/data
      environment:
        ES_JAVA_OPTS: -Xms256m -Xmx256m

      # Lets say you have a Kibana container that talks to Elasticsearch then you would link them this way:
      kibana:
      image: kibana:6.2.3
      links:
        - elasticsearch
      environment:
        ES_URL: http://elasticsearch:9200 
      # If you want people to connect to kibana directly then you can go ahead and open ports.
      # In an ideal world you will put both ES and Kibana behind Nginx as reverse proxy with some authentication on such as HTTP auth or even LDAP auth.
      ports:
        - "5601:5601"


      redis:
        image: docker.io/redis:3.0

      # You don't need to open ports here to the world.
      # As long as the containers that need to communicate with the redis container are linked using "links"
      # keyword, then the containers would be able to talk to each other using their hostname. redis will use the hostname:'redis'  



    sidekiq:
      build: .
      command: bundle exec sidekiq
      links:
        - db
        - redis
      volumes:
        - .:/app
      env_file:
        - .env

所以这将不允许您在本地主机上运行 redis，因为请记住容器有一个内部网络，它们用来相互通信。他们使用主机名来引用与之交互的服务或容器。因此，例如使用此组合文件，redis 将在 redis:6379 可用。这有意义吗？