Docker Networks Cheat Sheet¶
Docker creates bridge, host, and none networks on a typical Engine installation. For normal multi-container applications, I use a user-defined bridge: containers on it can resolve each other by container name and stay isolated from unrelated networks.
List and inspect networks¶
docker network ls
docker network inspect app-net
Show the network used by a container:
docker inspect app
Look under NetworkSettings.Networks in the output.
Create a bridge network¶
docker network create app-net
Docker uses the bridge driver when no driver is specified. To choose an address range:
docker network create \
--driver bridge \
--subnet 172.28.0.0/16 \
app-net
Use a subnet that does not overlap the host, VPN, or other Docker networks.
Start and connect containers¶
Start a container directly on the network:
docker run -d --name web --network app-net nginx
Connect an existing container:
docker network connect app-net api
Containers can belong to more than one network. Disconnect one when the path is no longer needed:
docker network disconnect app-net api
Isolate a network from external routes¶
An internal network allows connected containers to communicate with each other but does not give them the normal external route:
docker network create --internal backend-net
This is useful for a database or internal service. It does not replace application authentication or host firewall rules.
Remove networks¶
Disconnect or remove dependent containers first, then remove the network:
docker network rm app-net
Remove every unused custom network:
docker network prune
Review the prompt before confirming. The default bridge, host, and none networks are not removed.
Docker Compose example¶
Compose creates a project network automatically. Declare networks when you want a clear frontend/backend boundary:
services:
web:
image: nginx
networks: [frontend]
api:
image: example/api
networks: [frontend, backend]
db:
image: postgres
networks: [backend]
networks:
frontend: {}
backend:
internal: true
Legacy container links are not needed for this setup. User-defined networks provide name-based service discovery.