Chapter Seven
Networking
How containers talk — to each other, to the host, and to the world. The kernel primitives under every Docker network, why the default bridge gives you no name resolution and a user-defined bridge does, how the embedded DNS lets one container reach another by name, what publishing a port actually installs, the alternate network modes, how separate networks isolate tiers, and where single-host networking ends and orchestration begins.
Container networking looks like magic until you see it for what it is: the same Linux namespaces and cgroups from Chapter 1, applied to the network stack, with a virtual cable and a software switch wired up for you. Each container gets its own network namespace — its own interfaces, routing table, and loopback — and Docker joins that namespace to the outside world with a veth pair into a bridge and NAT for egress. Every behavior in this chapter follows from that one picture.
The chapter's spine is a single rule: always put a multi-container app on a user-defined bridge, never the default one. The default bridge gives containers no name resolution, so they can reach each other only by fragile IP addresses; a user-defined bridge adds an embedded DNS server, so proxy reaches web by name and web reaches db by name. From there it covers publishing ports to the host, the host/none/container: modes, isolating tiers across separate networks, and overlay networks — the deliberate edge where networking stops being single-host and hands off to Swarm and Kubernetes.
Topics in This Chapter
localhost inside a container is not the host.bridge has no DNS — reach others by IP or the deprecated --link; a user-defined bridge adds name resolution and isolation. Always create a user-defined bridge.127.0.0.11 that turns container names into current IPs. Why proxy_pass http://web:8000 works, what a network alias adds, and why resolving by name survives a restart.-p 80:80 installs, why EXPOSE publishes nothing, the security gap between 0.0.0.0 and 127.0.0.1 binding, and why only proxy is published while web and db are not.host shares the host stack and ignores -p; none gives only loopback; container: shares another container's namespace — the Kubernetes pod model.db unreachable from proxy, what docker network connect does at runtime, and isolation as deliberate topology.