Docker Networking Explained

# List networks
docker network ls

# Default networks
NETWORK ID     NAME      DRIVER
abc123         bridge    bridge    # Default for containers
def456         host      host      # Share host network
ghi789         none      null      # No networking

# Containers on default bridge can reach each other by IP only
docker run -d --name web nginx
docker run -d --name api my-api

# Get container IP
docker inspect web -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}'
# 172.17.0.2

# api can reach web by IP (not name!)
docker exec api curl http://172.17.0.2

# Create custom network
docker network create app-net

# Containers get DNS resolution by name
docker run -d --name web --network app-net nginx
docker run -d --name api --network app-net my-api

# api can reach web by name!
docker exec api curl http://web

# Map host port 8080 to container port 80
docker run -d -p 8080:80 nginx

# Map to specific interface
docker run -d -p 127.0.0.1:8080:80 nginx  # Only localhost

# Random host port
docker run -d -p 80 nginx
docker port <container>  # See assigned port

# Multiple ports
docker run -d -p 80:80 -p 443:443 nginx

# UDP
docker run -d -p 53:53/udp dns-server

services:
  frontend:
    image: my-frontend
    ports:
      - "3000:3000"       # Exposed to host
    networks:
      - frontend-net

  api:
    image: my-api
    expose:
      - "8080"             # Only internal, not to host
    networks:
      - frontend-net
      - backend-net

  postgres:
    image: postgres:16
    networks:
      - backend-net        # Not reachable from frontend

  redis:
    image: redis:7
    networks:
      - backend-net

networks:
  frontend-net:
  backend-net:
    internal: true         # No external access

# Containers resolve each other by name on user-defined networks
docker exec api nslookup web
# Server:    127.0.0.11 (Docker's embedded DNS)
# Name:      web
# Address:   172.18.0.2

# Service aliases
docker run -d --name db --network app-net --network-alias database postgres
# Both "db" and "database" resolve to this container

docker run -d --network host nginx
# Nginx listens on host's port 80 directly
# No port mapping needed
# No network isolation

# Inspect network
docker network inspect app-net

# Check container's networks
docker inspect api --format '{{json .NetworkSettings.Networks}}' | jq

# Test connectivity
docker exec api ping web
docker exec api curl http://web:8080/health
docker exec api nslookup postgres

# View port mappings
docker port my-container

# Network traffic
docker run --rm --net container:api nicolaka/netshoot tcpdump -i eth0

# Connect running container to a network
docker network connect backend-net api

# Disconnect
docker network disconnect frontend-net api

# Container on multiple networks
docker run -d --name api \
  --network frontend-net \
  my-api
docker network connect backend-net api

# Create network with custom subnet
docker network create \
  --subnet 10.10.0.0/24 \
  --gateway 10.10.0.1 \
  custom-net

# Assign static IP
docker run -d --name db \
  --network custom-net \
  --ip 10.10.0.100 \
  postgres

// ❌ Only accessible from inside container
app.listen(3000, '127.0.0.1')

// ✅ Accessible from other containers and host
app.listen(3000, '0.0.0.0')