I'm running several Java containers with Docker Compose, and they call each other's OAuth2-protected endpoints. We use Azure as the identity provider, so I configured a client ID, client secret, and scope, but I'm receiving an HTTP/HTTPS warning because some requests are being made over plain HTTP. All containers are currently using Compose's default network, with no additional networking or reverse proxy. Do I need certificates for this setup, or is it reasonable to disable OAuth locally?
2 Answers
Docker doesn’t change how OAuth2 or TLS works. The containers can reach one another over the Compose network, but whether HTTP is acceptable depends on which request is failing and your security requirements. Azure’s token and authorization endpoints should be accessed over HTTPS, and any externally exposed API should also use TLS. For service-to-service calls, use client-credentials flow and make sure the service URL, issuer, audience, and scope are configured correctly. If the application itself requires HTTPS, you’ll need certificates inside the containers or a reverse proxy such as Caddy, Nginx, or Traefik to terminate TLS.
For local Compose development, running the full Azure OAuth setup over HTTPS can be unnecessarily complicated. A common approach is to use a local authentication stub or mock identity provider, while keeping real Azure authentication enabled in staging and production. Another option is to put a small Caddy container in front of the services and let it handle local certificates. Don’t simply turn authentication off if the services are handling realistic data—use a development-only profile, test token, or mock instead.
The containers can still communicate on their private Compose network without exposing every service publicly. Just avoid assuming that the private network alone replaces authentication or encryption when the data is sensitive.
So the certificate is mainly an application or reverse-proxy concern rather than something Docker automatically provides? I’ll check which specific endpoint is rejecting HTTP.