Is it possible to isolate docker container in user-defined overlay network from outside internet?

With new network feature in docker 1.10 it is possible to create isolated overlay networks – which works very well. Containers in 2 separate networks can not talk to each other. Is it possible, however, to deny container in overlay network to reach public internet? Eg to make ping 8.8.8.8 fail, while having docker host connected to internet.

  • Running JAXB/XJC in Dockerfile yields in GConf Error
  • Google cloud sdks doesn't start preview for Docker image Mac OS
  • how to mount a Host volume to node.js docker container
  • Docker - Unable to locate package docker-engine
  • Understanding code executed after run command in Docker
  • Various ways of installing docker on Ubuntu
  • Docker Apache graceful shutdown
  • Boot2Docker on Mac - Accessing Local Files
  • Docker-compose throwing error
  • When mounting named volumes, under what conditions is data copied from the container?
  • Access container environment variables in inline run command
  • Accessing lamp container over lan using Kitematic
  • One Solution collect form web for “Is it possible to isolate docker container in user-defined overlay network from outside internet?”

    If you add the --internal flag when creating a network with the docker network create command, then that network will not have outbound network access:

    docker network  create --internal --subnet 10.1.1.0/24 mynetwork
    

    I assume — but have not tested — that this works for overlay networks as well as for host-local networks.

    Docker will be the best open platform for developers and sysadmins to build, ship, and run distributed applications.