Container Networking

Containers rarely run in isolation — they need to communicate with each other, with the host, and with the outside world. This lesson covers Docker's networking model, network drivers, port mapping, DNS resolution, and network isolation strategies.

---

Docker Network Drivers

Docker provides several built-in network drivers, each suited to different use cases.

Driver	Description	Use Case
bridge	Default; isolated network with NAT to host	Single-host container comms
host	Container shares the host's network namespace	Maximum network performance
none	No networking at all	Maximum isolation
overlay	Multi-host networking (Swarm/Kubernetes)	Cross-host container comms
macvlan	Assigns a MAC address; container appears on physical LAN	Legacy apps needing direct LAN

---

The Default Bridge Network

When you start a container without specifying a network, Docker connects it to the default bridge network.

# Run two containers on the default bridge
docker run -d --name web nginx:alpine
docker run -d --name api node:20-alpine sleep 3600

# Inspect the default bridge network
docker network inspect bridge

Limitations of the Default Bridge

• Containers can communicate by IP address but not by name
• No automatic DNS resolution between containers
• All containers on the default bridge can see each other — no isolation

Best practice: Always create custom bridge networks for your applications.

---

Custom Bridge Networks

Custom networks provide automatic DNS resolution, better isolation, and scoped connectivity.

# Create a custom network
docker network create my-network

# Run containers on the custom network
docker run -d --name web --network my-network nginx:alpine
docker run -d --name api --network my-network node:20-alpine sleep 3600

# Containers can now reach each other by name
docker exec api ping web
# PING web (172.18.0.2): 56 data bytes
# 64 bytes from 172.18.0.2: seq=0 ttl=64 time=0.089 ms

DNS Resolution

On a custom network, Docker runs an embedded DNS server. Containers can resolve each other by name:

+------------------+        DNS: "web" -> 172.18.0.2        +------------------+
|   api            | -------------------------------------> |   web            |
|   172.18.0.3     |                                        |   172.18.0.2     |
+------------------+                                        +------------------+
         |                    my-network                              |
         +------------------------------------------------------------+

---

Port Mapping

Containers are isolated from the host network by default. To make a service accessible from outside, you map a host port to a container port.

# Map host port 8080 to container port 80
docker run -d -p 8080:80 nginx:alpine

# Map to a specific host interface
docker run -d -p 127.0.0.1:8080:80 nginx:alpine

# Map a random host port
docker run -d -p 80 nginx:alpine
# Check which port was assigned:
docker port <container-id>

# Map multiple ports
docker run -d -p 8080:80 -p 8443:443 nginx:alpine

Port Mapping Diagram