Network Manipulation Basics

📙
The Docker Handbook
Search…
📙
The Docker Handbook
Table of Contents
Introduction to Containerization and Docker
Installing Docker
Hello World in Docker
Container Manipulation Basics
Image Manipulation Basics
Containerizing a JavaScript Application
Network Manipulation Basics
Containerizing a Multi-Container JavaScript Application
Composing Projects Using Docker-Compose
Conclusion
Network Manipulation Basics
So far in this article, you've only worked with single container projects. But in real life, the majority of projects that you'll have to work with will have at least more than one container and to be honest, working with a bunch of containers can be a little difficult if you don't understand the nuances of container isolation. So in this section of the article you'll get familiar with basic networking with Docker and will work hands on with a small multi-container project.
Well you've already learned in the previous section that containers are isolated environments. Now consider a scenario where you have a notes-api application powered by Express.js and a PostgreSQL database server running in two separate containers.
These two containers are completely isolated from each other and oblivious about each other's existence. So how do you connect the two? Ain't that a challenge?
You may think of two possible solution to this problem. They are as follows:
Accessing the database server using an exposed port.
Accessing the database server using its IP address and default port.
The first one is exposing a port from the postgres container and the notes-api will connect through that. Assuming that the exposed port from the postgres container is 5432. Now if you try to connect to 127.0.0.1:5432 from inside the notes-api container, you'll find that the notes-api can't find the database server at all.
The reason is that when you're saying 127.0.0.1 inside the notes-api container, you're simply referring to the localhost of that container and that container only. The postgres server simply doesn't exist there. As a result the notes-api application failed to connect.
The second solution you may think of is finding the exact IP address of the postgres container using container inspect command and use that with the port. Assuming the name of the postgres container is notes-api-db-server you can easily get the IP address by executing the following command:
1
docker container inspect --format='{{range .NetworkSettings.Networks}} {{.IPAddress}} {{end}}' notes-api-db-server
2
​
3
#  172.17.0.2
Copied!
Now given the default port for postgres is 5432, you can very easily access the database server by connecting to 172.17.0.2:5432 from the notes-api container.
There are problems in this approach as well. Using IP addresses to refer to a container is not recommended. Also, if the container gets destroyed and recreated, the IP address may change. Keeping track of these changing IP addresses can be pretty hectic.
Now that I've dismissed the possible wrong answers to the original question, the correct answer is, you connect them by putting them under a user-defined bridge network.
Network Basics
Network in Docker is another logical object like container and image. Just like the other two, there is a plethora of commands under the docker network group for manipulating networks. To list out the networks in your system, execute the following command:
1
docker network ls
2
​
3
# NETWORK ID     NAME      DRIVER    SCOPE
4
# c2e59f2b96bd   bridge    bridge    local
5
# 124dccee067f   host      host      local
6
# 506e3822bf1f   none      null      local
Copied!
You should see three networks in your system. Now look at the DRIVER column of the table here. These drivers are can be treated as the type of network. By default, Docker has five networking drivers. They are as follows:
bridge - The default networking driver in Docker. This can be used when multiple containers are running in standard mode and needs to communicate with each other.
host - Removes the network isolation completely. Any container running under a host network is basically attached to the network of the host system.
none - This driver disables networking for containers altogether. I haven't' found any use-case for this yet.
overlay - This is used for connecting multiple Docker daemons across computers and is out of the scope of this article.
macvlan - Allows assignment of MAC addresses to containers making them function like physical devices in a network.
There are also third-party plugins that allow you to integrate Docker with specialized network stacks. Out of the five mentioned above, you'll only work with bridge networking driver in this article.
Creating a User-Defined Bridge
Before you start creating your own bridge, I would like to take some time to discuss the default bridge network that comes with Docker. Let's begin by listing all the networks on your system:
1
docker network ls
2
​
3
# NETWORK ID     NAME      DRIVER    SCOPE
4
# c2e59f2b96bd   bridge    bridge    local
5
# 124dccee067f   host      host      local
6
# 506e3822bf1f   none      null      local
Copied!
As you can see, Docker comes with a default bridge network named bridge. Any container you run will be automatically attached to this bridge network:
1
docker container run --rm --detach --name hello-dock --publish 8080:80 fhsinchy/hello-dock
2
# a37f723dad3ae793ce40f97eb6bb236761baa92d72a2c27c24fc7fda0756657d
3
​
4
docker network inspect --format='{{range .Containers}}{{.Name}}{{end}}' bridge
5
# hello-dock
Copied!
Containers attached to the default bridge network can communicate with each others using IP addresses which I have already discouraged on the previous sub-section.
A user-defined bridge however has some extra feature over the default one. According to the official docs on this topic, some notable extra features are as follows:
User-defined bridges provide automatic DNS resolution between containers: This means containers attached to the same network can communicate with each others using the container name. So if you have two containers named notes-api and notes-db the API container will be able to connect to the database container using the notes-db name.
User-defined bridges provide better isolation: All containers are attached to the default bridge network by default which can cause conflicts among them. Attaching containers to a user-defined bridge can ensure better isolation.
Containers can be attached and detached from user-defined networks on the fly: During a container’s lifetime, you can connect or disconnect it from user-defined networks on the fly. To remove a container from the default bridge network, you need to stop the container and recreate it with different network options.
Now that you've learned quite a lot about a user-defined network, it's time to create one for yourself. A network can be created using the network create command. The generic syntax for the command is as follows:
1
docker network create <network name>
Copied!
To create a network with the name skynet execute the following command:
1
docker network create skynet
2
​
3
# 7bd5f351aa892ac6ec15fed8619fc3bbb95a7dcdd58980c28304627c8f7eb070
4
​
5
docker network ls
6
​
7
# NETWORK ID     NAME     DRIVER    SCOPE
8
# be0cab667c4b   bridge   bridge    local
9
# 124dccee067f   host     host      local
10
# 506e3822bf1f   none     null      local
11
# 7bd5f351aa89   skynet   bridge    local
Copied!
As you can see a new network has been created with the given name. No container is currently attached to this network. In the next sub-section, you'll learn about attaching containers to a network.
Attaching Containers to a Network
There are mostly two ways of attaching a container to a network. You can use the network connect command to attach a container to a network. The generic syntax for the command is as follows:
1
docker network connect <network identifier> <container identifier>
Copied!
To connect the hello-dock container to the skynet network, you can execute the following command:
1
docker network connect skynet hello-dock
2
​
3
docker network inspect --format='{{range .Containers}} {{.Name}} {{end}}' skynet
4
​
5
#  hello-dock
6
​
7
docker network inspect --format='{{range .Containers}} {{.Name}} {{end}}' bridge
8
​
9
#  hello-dock
Copied!
As you can see from the outputs of the two network inspect commands, the hello-dock container is now attached to both the skynet and the default bridge network.
The second way of attaching a container to a network is by using the --network option for container run or container create commands. The generic syntax for the option is as follows:
1
--network <network identifier>
Copied!
To run another hello-dock container to the attached to the same network, you can execute the following command:
1
docker container run --network skynet --rm --name alpine-box -it alpine sh
2
​
3
# lands you into alpine linux shell
4
​
5
/ # ping hello-dock
6
​
7
# PING hello-dock (172.18.0.2): 56 data bytes
8
# 64 bytes from 172.18.0.2: seq=0 ttl=64 time=0.191 ms
9
# 64 bytes from 172.18.0.2: seq=1 ttl=64 time=0.103 ms
10
# 64 bytes from 172.18.0.2: seq=2 ttl=64 time=0.139 ms
11
# 64 bytes from 172.18.0.2: seq=3 ttl=64 time=0.142 ms
12
# 64 bytes from 172.18.0.2: seq=4 ttl=64 time=0.146 ms
13
# 64 bytes from 172.18.0.2: seq=5 ttl=64 time=0.095 ms
14
# 64 bytes from 172.18.0.2: seq=6 ttl=64 time=0.181 ms
15
# 64 bytes from 172.18.0.2: seq=7 ttl=64 time=0.138 ms
16
# 64 bytes from 172.18.0.2: seq=8 ttl=64 time=0.158 ms
17
# 64 bytes from 172.18.0.2: seq=9 ttl=64 time=0.137 ms
18
# 64 bytes from 172.18.0.2: seq=10 ttl=64 time=0.145 ms
19
# 64 bytes from 172.18.0.2: seq=11 ttl=64 time=0.138 ms
20
# 64 bytes from 172.18.0.2: seq=12 ttl=64 time=0.085 ms
21
​
22
--- hello-dock ping statistics ---
23
13 packets transmitted, 13 packets received, 0% packet loss
24
round-trip min/avg/max = 0.085/0.138/0.191 ms
Copied!
As you can see, running ping hello-dock from inside the alpine-box container works because both of the containers are under the same user-defined bridge network and automatic DNS resolution is working.
Keep in mind though, in order for the automatic DNS resolution to work you must assign custom names to the containers. Using the randomly generated name will not work.
Detaching Containers from a Network
In the previous sub-section you've learned about attaching containers to a network. In this sub-section, you'll learn about how to detach them. The network disconnect command can be used for this task. The generic syntax for the command is as follows:
1
docker network disconnect <network identifier> <container identifier>
Copied!
To detach the hello-dock container from the skynet network, you can execute the following command:
1
docker network disconnect skynet hello-dock
Copied!
Just like the network connect command, the network disconnect command doesn't give any output either.
Getting Rid of Networks
Just like the other logical objects in Docker, networks can be removed using the network rm command. The generic syntax for the command is as follows:
1
docker network rm <network identifier>
Copied!
To remove the skynet network from your system, you can execute the following command:
1
docker network rm skynet
Copied!
You can also use the network prune command to remove any unused networks from your system. The command also has the -f or --force and -a or --all options.
Containerizing a JavaScript Application
Containerizing a Multi-Container JavaScript Application
Last modified 9mo ago
Copy link
Contents
Network Basics
Creating a User-Defined Bridge
Attaching Containers to a Network
Detaching Containers from a Network
Getting Rid of Networks