Networking Basics

Docker Network Drivers

Docker provides several network drivers, each serving different use cases:

Bridge (Default)

When you run a container without specifying a network, it connects to the bridge network. Containers on a bridge network can communicate with each other via IP addresses, but cannot be reached from outside without port mapping.

# Default bridge network
docker network ls
NETWORK ID     NAME      DRIVER    SCOPE
a1b2c3d4e5f6   bridge    bridge    local
f6e5d4c3b2a1   host      host      local
1a2b3c4d5e6f   none      null      local

# Run two containers on default bridge
docker run -d --name web1 nginx
docker run -d --name web2 nginx

# They can ping each other by IP
docker exec web1 ping -c 2 web2
# Works because default bridge provides DNS

# BUT: No automatic DNS resolution on default bridge
# Must use IP addresses

Host

The host network removes network isolation. The container uses the host's network stack directly. No port mapping needed — the container binds to the host's ports.

# Container shares host network
docker run -d --network host nginx
# Nginx listens on host's port 80 directly
# Access via http://localhost:80 (no -p flag needed)

Limitations: Only one container can bind to a given port on the host. No network isolation. Not available on Docker Desktop for Mac/Windows.

None

The none driver disables all networking. The container gets only a loopback interface.

docker run -d --network none alpine ifconfig
# Only shows lo (loopback) - no eth0

Overlay

Overlay networks span multiple Docker hosts (used in Swarm mode). They create a distributed network across machines.

# Create overlay network (requires Swarm)
docker network create --driver overlay my-overlay

# Attach services to the same overlay
docker service create --name web --network my-overlay nginx

Macvlan

Macvlan assigns a MAC address to each container, making it appear as a physical device on the network.

docker network create -d macvlan \
  --subnet=192.168.1.0/24 \
  --gateway=192.168.1.1 \
  -o parent=eth0 \
  my-macvlan

Custom Bridge Networks

Custom bridge networks provide automatic DNS resolution, which is critical for service-to-service communication.

Creating and Using Custom Networks

# Create custom bridge network
docker network create --driver bridge app-network

# Run containers on the network
docker run -d --name web --network app-network nginx
docker run -d --name api --network app-network myapi:latest

# Containers can reach each other by NAME
docker exec api ping web
# PING web (172.18.0.2): 56 data bytes
# 64 bytes from 172.18.0.2: seq=0 ttl=64 time=0.089 ms

Network Isolation

Containers on different networks cannot communicate by default:

# Frontend network
docker network create frontend
# Backend network
docker network create backend

# Web server on frontend only
docker run -d --name web --network frontend nginx

# API on both networks
docker run -d --name api --network frontend myapi
docker network connect backend api

# Database on backend only
docker run -d --name db --network backend postgres:16

# api can reach both web and db
# web CANNOT reach db (different networks)
# db CANNOT reach web (different networks)

Network Configuration

# Create network with specific subnet
docker network create \
  --subnet 10.0.1.0/24 \
  --gateway 10.0.1.1 \
  --ip-range 10.0.1.0/25 \
  --driver bridge \
  my-network

# Create network with DNS server
docker network create \
  --dns 8.8.8.8 \
  --dns 8.8.4.4 \
  my-network

# Connect container to multiple networks
docker network connect backend api
docker network disconnect frontend api

# Inspect network
docker network inspect my-network

Network Troubleshooting

# See which networks a container is on
docker inspect --format '{{json .NetworkSettings.Networks}}' web

# Check container IP
docker inspect --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' web

# Test connectivity from container
docker exec web ping -c 3 api

# Check DNS resolution
docker exec web nslookup api

# View network namespace
docker exec web cat /etc/hosts
# 172.18.0.3    api

Docker Network Default Behavior

Container Network Architecture

How Docker Networking Works Internally

When Docker creates a container, it:

1. Creates a network namespace — an isolated network stack with its own interfaces, routing table, and firewall rules
2. Creates a veth pair (virtual ethernet) — one end in the container (eth0), one end on the host
3. Attaches the host end to a Linux bridge (e.g., docker0 for default bridge, or a custom bridge)
4. Assigns an IP address from the network's subnet

Container          Host
┌──────────┐    ┌──────────────────────┐
│ eth0     │    │ veth1234             │
│ 172.18.  │◄──►│ docker0 bridge       │
│ 0.2/16   │    │ 172.18.0.1/16        │
└──────────┘    └──────────────────────┘

NAT and Port Mapping

When you use -p 8080:80, Docker sets up iptables rules:

# Docker creates these iptables rules:
# PREROUTING: DNAT traffic to host:8080 → container:80
# FORWARD: Allow traffic to container network
# MASQUERADE: SNAT for container outbound traffic

# Inspect iptables rules for port mapping
sudo iptables -t nat -L -n | grep 8080
DNAT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 to:172.18.0.2:80

Inter-Container Communication

On the same bridge network:

• Containers can communicate freely via IP
• Custom bridges provide DNS resolution by container name
• Default bridge does NOT provide DNS (security reason)

Outbound Internet Access

Containers on bridge networks access the internet through NAT:

Container (172.18.0.2) → Bridge (172.18.0.1) → Host eth0 → Internet

Docker configures IP forwarding and masquerading automatically:

# Check IP forwarding
cat /proc/sys/net/ipv4/ip_forward
# 1 (enabled)

# Docker manages this via iptables
sudo iptables -t nat -L POSTROUTING -n
MASQUERADE  all  --  172.18.0.0/16  0.0.0.0/0

Network Performance

• Bridge networking: Adds ~1-3% overhead for most workloads
• Host networking: Zero overhead (no NAT, no bridge)
• Overlay networking: Additional encryption overhead
• For performance-critical applications, consider host networking or SR-IOV

Network Inspection and Troubleshooting

Inspect Network Details

# Full network configuration
docker network inspect bridge

# Get specific container's IP on a network
docker inspect --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' web

# List all container IPs
docker network inspect bridge --format '{{range .Containers}}{{.Name}}: {{.IPv4Address}}{{println}}{{end}}'

# Check container's network mode
docker inspect --format '{{.HostConfig.NetworkMode}}' web

Debug Connectivity

# Exec into container and test connectivity
docker exec -it web sh

# Ping another container
ping -c 3 api

# Test DNS resolution
nslookup api
getent hosts api

# Check container's network config
cat /etc/resolv.conf
# nameserver 127.0.0.11

# Check routing table
ip route
# default via 172.18.0.1 dev eth0

# Check network interfaces
ip addr show eth0
# inet 172.18.0.2/16 brd 172.18.255.255 scope global eth0

# Check listening ports
ss -tlnp
# or
netstat -tlnp

Common Issues and Fixes

Container cannot resolve DNS:

# Ensure container is on a custom bridge (not default)
docker network create mynet
docker run --network mynet myapp

# Or add DNS to default bridge
docker run --dns 8.8.8.8 myapp

Container cannot reach another container:

# Check both are on the same network
docker inspect --format '{{json .NetworkSettings.Networks}}' web api

# Connect to network if not
docker network connect mynet api

Port mapping not working:

# Check port mappings
docker port web

# Check iptables rules
sudo iptables -t nat -L -n

# Check if port is in use
ss -tlnp | grep 8080

No internet from container:

# Check IP forwarding
cat /proc/sys/net/ipv4/ip_forward
# Should be 1

# Enable if disabled
sudo sysctl -w net.ipv4.ip_forward=1

# Check DNS
docker exec web cat /etc/resolv.conf

Cleanup

# Remove unused networks
docker network prune

# Force remove a network (disconnect containers first)
docker network rm mynet