@slezhuk thats absolutely correct, being specific about the IP doesn’t mitigate the risk, security within your own faux-private network is your own project.

The fact that @digitalocean doesn’t have true private networks is certainly a hurdle ;-)

Not sure if this is one of the examples you’ve already come across, but I find this blog post helpful. The cloud-config file that it describes writes a set of IPTables rules to /var/lib/iptables/rules-save and enables a systemd unit file which will run /sbin/iptables-restore /var/lib/iptables/rules-save to apply the rule set.

You can run this unit file manually with:

 sudo systemctl start iptables-restore.service

Though do note that the IPTables rules used in that post explicitly open port 80, so your Nginx container would still be visible. You’ll still need to edit the rules to suit your needs. This tutorial, while written targeting Ubuntu, should point you in the right direction for learning more about IPTable rules.

this may be a little late but …

the problem you are having is more likely how you are starting the container.
if you are using docker run .... -p 80:80 ... then the port will open on all interfaces.
if you want it only on the private interface, then you need to docker run ... -p $COREOS_PRIVATE_IPV4:80 ...