Docker Container Networking and Isolation
You will create user-defined bridge networks so containers reach each other by name while staying isolated from unrelated containers. By the end you will prove a database is reachable by its app but unreachable from outside its network.
Learning Objectives
- Create user-defined bridge networks with built-in DNS.
- Connect containers by name instead of IP.
- Verify network isolation between groups.
- Time: ~3 hours · Difficulty: Intermediate · Prereqs: Docker installed.
Architecture Overview
graph TD
subgraph app-net
Web[web] -->|DNS: db:5432| DB[db]
end
subgraph other-net
X[unrelated]
end
X -. cannot reach .- DB
Environment Setup
You will need: Docker and two or three small images (nginx and postgres work well).
Before you begin: the default bridge has no DNS; always use user-defined networks.
Step-by-Step Execution
01
Create a user-defined network
User-defined bridges provide automatic name resolution between attached containers.
docker network create app-net02
Attach containers to it
docker run -d --name db --network app-net postgres:16 && docker run -d --name web --network app-net nginx:stable03
Resolve by name from the app
$ docker exec web getent hosts db
172.18.0.2 db
Progress So Far
graph LR
A[01 Create net] -->|done| B[02 Attach]
B -->|done| C[03 Resolve by name]
C -->|next| V[Verify isolation]
style A fill:#1a4a1a,stroke:#00ff00,color:#fff
style B fill:#1a4a1a,stroke:#00ff00,color:#fff
style C fill:#1a4a1a,stroke:#00ff00,color:#fff
style V fill:#1a1a2e,stroke:#00d4ff,color:#e0e0e0
Testing & Validation
docker run --rm --name probe alpine sh -c "nc -zv db 5432 || echo isolated"The probe (not on app-net) should print isolated, while web can reach db. That confirms isolation plus intended connectivity.
Troubleshooting
- Name not resolving: the default bridge lacks DNS; attach to a user-defined network.
- Containers can all reach each other: they share one network; separate concerns into distinct networks.
- Port not reachable from host: publish it with
-p; network membership alone does not expose it.
Extension Ideas
- Define the whole topology declaratively in Docker Compose.
- Move isolation to L3 in Kubernetes Services & Networking.
- Enforce policy with the Zero-Trust microsegmentation lab.
Key Results
- Connected containers by name via user-defined DNS.
- Isolated unrelated containers onto separate networks.
- Proved both connectivity and isolation with a live probe.
- Established the networking model used by Compose and K8s.