Networks - how they work in Docker and how to work with them

In Docker, networks allow containers to communicate with each other and with the outside world. By default, every container is isolated and only has access to the network it is connected to. Networks provide a secure, controlled way to handle this communication.

Docker provides a few different types of networks, each designed for different use cases.

Bridge (default)

• This is the default network for containers started without specifying a network.
• It creates a private internal network on the host.
• Containers on the same bridge can talk to each other using IP or container names.
• Useful for standalone containers.

Example:

Both containers are placed in the bridge network and can ping each other via container names.

Host

• Removes network isolation between the container and the Docker host.
• The container uses the host’s network stack directly.
• No port mapping is needed.
• Only available on Linux.

Example:

Warning: Can cause port conflicts and reduces container isolation.

None

• The container has no network access.
• Useful for security or testing.

Example:

This will fail due to no network access.

User-defined bridge networks

Instead of using the default bridge, you can create your own:

Then, connect containers to it:

Benefits:

• Containers can resolve each other by name.
• You can define custom subnets, gateways, etc.
• Better for multi-container applications.

Docker compose and networks

Docker Compose makes networking between services very easy. By default:

• It creates a dedicated network for your Compose project.
• All services are automatically attached to this network.
• Services can talk to each other using the service name as the hostname.

Example docker-compose.yml:

The web service can talk to db using the hostname db.

You can also define and attach custom networks in compose files:

Here:

• app and proxy can talk on frontend.
• proxy and db can talk on backend.
• But app and db cannot talk directly.

Inspecting Docker networks

List all networks:

Inspect a network:

This will show:

• Containers attached to the network
• IP address ranges
• Subnet information
• Gateway

Connecting & disconnecting containers to networks

You can manually connect or disconnect containers to/from networks.

Connect:

Disconnect:

Network isolation and security

• Containers on different user-defined bridge networks cannot communicate with each other unless explicitly connected.
• This allows you to enforce separation between environments (e.g., staging vs. production).
• You can use firewalls and iptables rules for tighter control if needed (advanced usage).

Publishing Ports to Host

Even if containers can communicate internally, external access to a container (like visiting in a browser) requires exposing ports:

This maps host port 8080 to container port 80.

With Docker Compose:

Example: Connecting a Frontend, Backend, and Database:

All three services are on the same network and can communicate using names like db or backend.

Cleaning up networks

List all networks:

Remove unused networks:

Remove a specific one: