Docker Networking Fundamentals
Docker Networking Fundamentals
Docker networking is the mechanism that allows containers to communicate with each other, communicate with the Docker host, access external networks, and expose applications to external clients.
Understanding Docker networking is essential before working with Docker Compose, microservices, databases, APIs, Kubernetes, and production container deployments.
Docker containers have networking enabled by default. A container sees a network interface, IP address, gateway, routing information, and DNS configuration, just as a networked system would.
What Is Docker Networking?
Docker networking provides connectivity between:
| Concept | Remember |
|---|---|
| Docker Network | Provides connectivity and isolation for containers |
| Bridge | Common networking driver for containers on the same host |
| User-defined Bridge | Provides isolation and automatic DNS-based container-name resolution |
| Container IP | Assigned from the Docker network subnet |
| Container Name | Can be used for service discovery on user-defined networks |
-p | Publishes a container port through the Docker host |
EXPOSE | Declares a container port; it does not itself publish it |
| Host Network | Container shares the host's network namespace |
| None Network | Disables normal container networking |
| Overlay | Enables networking across multiple Docker hosts |
| NAT/Masquerading | Used by default for external connectivity from bridge networks |
The key questions when troubleshooting Docker networking are:
- Which network is the container connected to?
- Can the source and destination containers communicate on that network?
- Can the destination be resolved by DNS/container name?
- Is the application listening on the expected container port?
- Does the host need a published port?
- Is the port published on the expected host address?
- Are firewall/NAT/routing rules affecting the connection?
Docker Commands
| Command | Purpose |
|---|---|
docker network ls | List Docker networks |
docker network create my-net | Create a network |
docker network inspect my-net | Inspect network configuration |
docker network rm my-net | Remove a network |
docker network connect my-net container | Connect a container to a network |
docker network disconnect my-net container | Disconnect a container |
docker inspect container | Inspect container configuration |
docker port container | Display published ports |
NAT and Masquerading :Â Docker bridge networks commonly use NAT/masquerading for outbound container traffic.
Container
172.18.0.2
│
â–¼
Docker Host
192.168.1.10
│
â–¼
Internet
EXPOSE vs -p
EXPOSE | -p / --publish |
|---|---|
| Declares/documentation for a container port | Publishes a port to the host |
| Does not itself publish the port | Creates the host-to-container mapping |
| Usually appears in Dockerfile | Used with docker run / docker create |
Example: EXPOSE 80 | Example: -p 8080:80 |
Default Bridge vs User-Defined Bridge
| Feature | Default bridge | User-defined bridge |
|---|---|---|
| Automatically created | Yes | No |
| Container communication | Yes | Yes |
| DNS by container name | Not normally | Yes |
| Better isolation | Limited | Yes |
| Can connect/disconnect containers dynamically | Limited | Yes |
| Recommended for application stacks | No | Yes |
Bridge Networks
│
├── Default bridge
│
└── User-defined bridge
Docker recommends user-defined bridge networks rather than relying on the default bridge for application stacks. User-defined bridges provide better isolation and automatic DNS-based container-name resolution.Â
Bridge Network
The bridge driver is the default Docker network driver.
When Docker Engine starts on Linux, it creates a default bridge network. Containers started without specifying another network are connected to this default bridge.
Docker Host
│
├── docker0 / bridge
│
├── Container A
│ └── 172.x.x.x
│
├── Container B
│ └── 172.x.x.x
│
└── Container C
└── 172.x.x.x
The bridge provides a virtual network through which containers can communicate.
Docker Network Drivers
Docker provides several built-in network drivers.
Network DriverPurposebridgeCommonly used for containers running on the same Docker hosthostRemoves network isolation between the container and Docker hostnoneCompletely disables container networkingoverlayConnects containers/services across multiple Docker hosts, particularly with SwarmmacvlanMakes containers appear as physical devices on the networkipvlanProvides control over IPv4/IPv6 addressing without assigning unique MAC addresses
