Container Networking

Introduction

Real apps have several containers: a web server, an API, a database. They need to talk to each other, and you want strangers to reach only the parts you choose.

The simple explanation

Containers on the same Docker network can reach each other. Only ports you publish are reachable from outside.

Network types

• bridge (default): a private network on your computer. Containers on it can talk to each other and reach the internet, but the outside world cannot reach them unless you publish ports.
• host: the container shares the computer's network directly. Fewer protections, so use it only when needed.
• none: no networking at all.

List them with docker network ls.

Publishing ports

docker run -d -p 8080:80 nginx

This maps port 8080 on your computer to port 80 inside the container. By default Docker publishes on all interfaces. To make a service reachable only from your own machine, bind it to localhost:

docker run -d -p 127.0.0.1:8080:80 nginx

User-defined networks and names

On a user-defined bridge network, containers can find each other by name. This is built-in DNS.

docker network create app-net
docker run -d --name db --network app-net -e POSTGRES_PASSWORD=change-me postgres:16
docker run -d --name api --network app-net -p 127.0.0.1:3000:3000 my-api

Inside the api container, the database is reachable at the hostname db, for example postgres://postgres:change-me@db:5432/postgres. Use a strong password of your own, not the example.

Notice that the database has no published port. It is reachable only from containers on app-net, not from the outside. That is a good default for databases and internal services.

Debugging

docker network inspect app-net      # who is connected, and their IPs
docker exec -it api sh              # open a shell inside a running container
docker logs api                     # see output and errors

Common problems:

• Using localhost inside a container to reach another container. localhost there means the container itself. Use the service name.
• Forgetting to put both containers on the same network.
• A service listening only on 127.0.0.1 inside its container. It must listen on 0.0.0.0 to accept traffic from other containers.

Try it yourself

Create a network, start two containers on it, and from one use ping or curl to reach the other by name. Then check that a container without a published port cannot be reached from your browser.

Summary

• Bridge networks keep containers private, and only published ports are open to the outside.
• On a user-defined network, containers reach each other by name.
• Publish only what must be public, and bind to 127.0.0.1 for local-only access.