Docker
Intermediate 16 min read Docker

Docker Networking

Container networking is the bridge between isolated processes and the outside world. Understand bridge, host, none and overlay networks, and how to wire multi-container apps.

bridgeoverlayhost networkport mappingDNSnetworks
Prerequisites: What is Docker? Docker Containers & Lifecycle
Introduction

What is this?

Docker networks give containers their own network namespace and provide DNS-based service discovery. The default bridge network connects containers on a private subnet; overlay networks connect containers across multiple hosts in a swarm; host mode shares the host's network stack directly.

Motivation

Why do you need it?

  • Containers need isolation from each other and the host, but still need to communicate.
  • Embedded DNS lets services reference each other by name, not by IP that changes.
  • Port mapping exposes only the endpoints you intend to the outside world.
  • Custom networks give you fine-grained control: which containers can talk to which.
Think about it

Mental model

Imagine

A building with numbered apartments

Think of

Docker networks

Each apartment has its own address; a reception desk (DNS) routes guests by name to the right room. Only the front door (published port) is visible from the street.

Mechanics

How it works

  • By default Docker creates a bridge network where every container gets a private IP (e.g. 172.17.0.0/16).
  • Published ports (-p host:container) create iptables rules forwarding host traffic into the container.
  • Custom user-defined bridge networks provide automatic DNS resolution by container name.
  • The host network mode binds containers directly to host interfaces — no isolation, but max performance.
  • Overlay networks use VXLAN encapsulation so containers on different hosts share one virtual subnet.

Bridge networking with port publishing.

Host port 8080
iptables NAT
docker0 bridge
Container eth0
Reference

Key commands

docker network ls

List networks.

docker network create mynet

Create a custom bridge network.

docker network connect mynet web

Attach a running container to another network.

docker run --network host app

Run with the host network stack.

docker network inspect mynet

Show containers and subnet of a network.

Hands-on

Examples

Two containers talking by name

Two containers talking by name
docker network create app-net
docker run -d --name db --network app-net postgres:16
docker run -d --name api --network app-net -p 8080:3000 myapi
 
# Inside the api container, resolve the db by name:
docker exec api ping -c1 db

Both containers join the custom app-net bridge, which gives them embedded DNS. The API can reach the database at hostname 'db' regardless of its IP, while only the API is exposed on host port 8080.

Real world

In production

  • User-defined bridge networks isolate application tiers (db-only network for the DB).
  • Overlay networks enable multi-host service discovery in a Swarm or with 3rd-party plugins.
  • Published ports are the only external surface; everything else stays on private subnets.
  • Network policies (via orchestrators like Kubernetes) restrict east-west traffic.
Guidelines

Best practices

  • Use custom networks for DNS by container name; the default bridge does not resolve names.
  • Never expose a database port to the host — connect app and DB on a shared network instead.
  • Use --network host only when you need it (high-throughput local services); it skips isolation.
  • Combine networks with docker compose for repeatable, readable topology.
Watch out

Common mistakes

  • Publishing DB/Redis ports to the host when only other containers need them.
  • Relying on container IPs (change on recreation) instead of DNS names.
  • Using the default bridge and wondering why name resolution fails.
  • Running everything with --network host and losing all isolation.
Root cause analysis

Common issues

Error
Unable to resolve host: other-container
Root cause

Containers on different networks, or default bridge without DNS.

Fix

Connect both to the same custom network: docker network connect app-net api.

Error
Port is already allocated
Root cause

Host port already bound.

Fix

docker ps to find the container, then change host port or stop the other service.

Error
No route to host / connection refused between containers
Root cause

Networks don't overlap or the target container isn't listening on that interface.

Fix

Verify both on the same network and that the target binds 0.0.0.0 inside the container.

When things break

Debugging tips

  • docker network inspect NET to see members and subnets.
  • docker exec <ctr> cat /etc/resolv.conf to see embedded DNS config.
  • docker exec <ctr> getent hosts <other> to test DNS resolution.
  • docker port <ctr> to show published ports.
Interviews

Interview checkpoint

Practice

Hands-on lab

Multi-Container Networking
35 min · intermediate
In progress
Objectives
  • Create a custom bridge network
  • Connect an API and database by DNS name
  • Restrict DB exposure to the internal network only
  • Debug connectivity between containers

Multi-Container Networking

35 min · intermediate

0/5 steps
0%
sandbox · Linux sandbox
$
Try these commands
Test yourself

Quick quiz

0/3
1

Which network mode gives a container the same network stack as the host?

2

What makes custom bridge networks resolve container names automatically?

3

Which network type is used to connect containers on different hosts?

Quick reference

Cheat sheet

Networking
docker network lsList networks
docker network create NCreate custom bridge
docker run --network N appJoin a network
docker network connect N ctrAttach running container
-p 8080:80Publish host:container port
--network hostUse host network stack
Go deeper

Official documentation

Networking overview
docs
Bridge networks
docs
Overlay networks
docs
Publish container ports
docs