Anyway to make the node-exporter and cadvisor local only to the prometheus container

Question

I am using prometheus, node-exporter, and cadvisor services successfully inside a docker container, all on different ports of the same hosts. I'm using docker compose for all the services:

version: '2'


volumes:
    grafana_data: {}

services:

    prometheus:
        image: prom/prometheus
        privileged: true
        volumes:
            - ./prometheus.yml:/etc/prometheus/prometheus.yml
            - ./alertmanager/alert.rules:/alertmanager/alert.rules
        command:
            - '--config.file=/etc/prometheus/prometheus.yml'
        ports:
            - '9090:9090'

    node-exporter:
        image: prom/node-exporter
        ports:
            - '9100:9100'
    cadvisor:
        image: google/cadvisor:latest 
        privileged: true
        volumes:
            - /:/rootfs:ro
            - /var/run:/var/run:rw
            - /var/lib/docker/:/var/lib/docker:ro
            - /dev/disk/:/dev/disk:ro
            - /cgroup:/sys/fs/cgroup:ro
        ports:
            - '8080:8080'

I need only prometheus to access cadvisor. I want to know if there's any way to make the cadvisor service local only to the container because at the moment it is accessible outside of the contatiner.

Answer 1

The simple solution to your problem would be to close the ports for that service. Just delete the ports section for each of those services. Also, you for container to container communication you could use container ports instead of your service ports. You can reference the target container by its service name.

Answer 2

If you don't want to access the service externally, don't publish the ports for that service, delete the ports section from each of those services. The resulting compose file will look like:

version: '2'
volumes:
    grafana_data: {}
services:
    prometheus:
        image: prom/prometheus
        privileged: true
        volumes:
            - ./prometheus.yml:/etc/prometheus/prometheus.yml
            - ./alertmanager/alert.rules:/alertmanager/alert.rules
        command:
            - '--config.file=/etc/prometheus/prometheus.yml'
        ports:
            - '9090:9090'

    node-exporter:
        image: prom/node-exporter
        # removed "ports" from here

    cadvisor:
        image: google/cadvisor:latest 
        privileged: true
        volumes:
            - /:/rootfs:ro
            - /var/run:/var/run:rw
            - /var/lib/docker/:/var/lib/docker:ro
            - /dev/disk/:/dev/disk:ro
            - /cgroup:/sys/fs/cgroup:ro
        # removed "ports" from here