> a simple network policy and blocking the container from using DNS

Can you please point to some resources that can help with how to do this?

Not sure about the DNS part, but NetworkPolicies should be familiar to anyone who takes Kubernetes seriously.

https://kubernetes.io/docs/concepts/services-networking/netw...

I use Docker (in Unraid).

The web frontend could still send secrets to third parties.

For extra security, an intermediary can set Content Security Policy (CSP) headers that instruct browsers to only connect to certain domains. CSP headers aren't a total solution, but they're a good tool in the toolkit for redundancy against exfiltration.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

It could be a system without a web ui, like a database or database proxy. Or it could have multiple web and native UIs (that are open source), e.g. a matrix service.

Why do you think that DNS is required? Anything malicious could (and likely should) hard-code an IP.

You ensure DNS is disabled to stop DNS exfil. You can google it, but basically they exfil data by looking up encoded subdomains.

Hardcoding an IP won't help if the network policy disallows all network access.