Docker Networking Explained

Docker networking enables container communication. Here's how to configure networks effectively.

Network Types#

# List networks
docker network ls

# Network drivers:
# - bridge: Default for standalone containers
# - host: Remove network isolation
# - none: Disable networking
# - overlay: Multi-host networking (Swarm)
# - macvlan: Assign MAC address

# Create custom bridge network
docker network create mynetwork

# Create with options
docker network create \
  --driver bridge \
  --subnet 172.20.0.0/16 \
  --gateway 172.20.0.1 \
  --ip-range 172.20.240.0/20 \
  mynetwork

# Inspect network
docker network inspect mynetwork

Bridge Networks#

# Default bridge
# Containers get random IP, communicate via IP only

docker run -d --name container1 nginx
docker run -d --name container2 nginx

# Get container IP
docker inspect container1 | grep IPAddress

# Ping works by IP only on default bridge
docker exec container2 ping 172.17.0.2

# Custom bridge network
# Containers can communicate by name (DNS)

docker network create app-network

docker run -d --name web --network app-network nginx
docker run -d --name api --network app-network node:alpine

# DNS works on custom networks
docker exec api ping web  # Works!

# Connect existing container to network
docker network connect app-network container1

# Disconnect from network
docker network disconnect app-network container1

Docker Compose Networking#

# docker-compose.yml
version: '3.8'

services:
  web:
    image: nginx
    ports:
      - "80:80"
    networks:
      - frontend
      - backend

  api:
    image: node:alpine
    networks:
      - backend
      - database

  db:
    image: postgres
    networks:
      - database

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge
  database:
    driver: bridge
    internal: true  # No external access

# Services communicate by service name
# web can reach api at http://api:3000
# api can reach db at postgres://db:5432

# Advanced network configuration
version: '3.8'

services:
  app:
    networks:
      frontend:
        ipv4_address: 172.20.0.10
        aliases:
          - app.local

networks:
  frontend:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.20.0.0/16
          gateway: 172.20.0.1
    driver_opts:
      com.docker.network.bridge.name: br-frontend

Port Mapping#

# Map container port to host
docker run -p 8080:80 nginx
# Access at localhost:8080

# Map to specific interface
docker run -p 127.0.0.1:8080:80 nginx
# Only accessible from localhost

# Random host port
docker run -p 80 nginx
docker port <container>  # See assigned port

# UDP ports
docker run -p 53:53/udp dns-server

# Multiple ports
docker run -p 80:80 -p 443:443 nginx

# docker-compose.yml port mapping
services:
  web:
    image: nginx
    ports:
      - "80:80"
      - "443:443"
      - "127.0.0.1:8080:8080"  # Localhost only
    expose:
      - "3000"  # Only expose to other containers, not host

Container DNS#

# Custom DNS server
docker run --dns 8.8.8.8 alpine

# Custom hostname
docker run --hostname myhost alpine

# Add hosts entry
docker run --add-host db:192.168.1.100 alpine

# Disable DNS
docker run --dns-opt ndots:1 alpine

# docker-compose.yml DNS settings
services:
  app:
    dns:
      - 8.8.8.8
      - 8.8.4.4
    dns_search:
      - example.com
    extra_hosts:
      - "host.docker.internal:host-gateway"

Host Networking#

# Container uses host's network stack
docker run --network host nginx

# No port mapping needed
# Container binds directly to host ports
# No network isolation
# Best performance

# Use cases:
# - Performance-critical applications
# - Applications that need to bind to many ports
# - Network monitoring tools

Network Security#

# Isolate networks
version: '3.8'

services:
  frontend:
    networks:
      - public

  backend:
    networks:
      - public
      - private

  database:
    networks:
      - private  # Only backend can reach it

networks:
  public:
    driver: bridge
  private:
    driver: bridge
    internal: true  # No internet access

# Limit container network access
docker run --cap-drop NET_RAW alpine  # Disable ping

# Read-only network config
docker run --read-only alpine

# Disable inter-container communication
docker network create --driver bridge \
  -o "com.docker.network.bridge.enable_icc=false" \
  isolated

Troubleshooting#

# Check container network settings
docker inspect --format='{{json .NetworkSettings}}' container_name

# Check connected networks
docker inspect --format='{{range .NetworkSettings.Networks}}{{.NetworkID}}{{end}}' container_name

# Test connectivity from container
docker exec container_name ping other_container
docker exec container_name curl http://other_container:port

# Check DNS resolution
docker exec container_name nslookup service_name

# View network traffic
docker run --rm --net container:target_container nicolaka/netshoot tcpdump

# Debug network namespace
docker run -it --net container:target_container nicolaka/netshoot

# Check iptables rules
sudo iptables -L -n -v | grep docker

Multi-Host Networking#

# Overlay network (requires Swarm)
docker swarm init
docker network create -d overlay my-overlay

# Connect services across hosts
docker service create --name web --network my-overlay nginx

# Attachable overlay for standalone containers
docker network create -d overlay --attachable my-overlay

# docker-compose.yml with external network
version: '3.8'

services:
  app:
    networks:
      - my-overlay

networks:
  my-overlay:
    external: true

Best Practices#

Design:
✓ Use custom networks for isolation
✓ Separate frontend/backend/database
✓ Use internal networks for databases
✓ Name networks descriptively

Security:
✓ Limit exposed ports
✓ Use internal networks
✓ Disable ICC when not needed
✓ Use TLS for service communication

Performance:
✓ Use host networking when needed
✓ Minimize network hops
✓ Use overlay sparingly
✓ Monitor network metrics

Docker networking enables flexible container communication. Use custom bridge networks for service discovery, isolate sensitive services with internal networks, and leverage Compose for multi-container networking. Proper network design improves both security and maintainability.