Stage 4 · Provision
Running & Networking Containers
Container Networks
Create bridge networks, use DNS service names, inspect IPs, and compare host networking.
Default Networks
Docker creates three networks by default: bridge, host, and none. The bridge network is the default — containers without a --network flag connect to it. Containers on the same bridge network can communicate with each other.
docker network ls
# NETWORK ID NAME DRIVER SCOPE
# abc123... bridge bridge local
# def456... host host local
# ghi789... none null localThe bridge driver creates a Linux bridge on the host. Containers connected to it get their own IP addresses and can communicate through the bridge.
User-Defined Bridge
User-defined bridge networks provide automatic DNS resolution between containers, better isolation, and configurable options. Always use user-defined bridges instead of the default bridge for multi-container applications.
# Create a custom bridge network
docker network create app-network
# Run containers on the network
docker run -d --name db --network app-network postgres:16-alpine
docker run -d --name api --network app-network myapp
# Containers can reach each other by name
docker exec api ping db # Works!
# Remove network and containers
docker rm -f db api
docker network rm app-networkUser-defined bridges provide automatic DNS. Containers can reach each other by container name. The default bridge does not provide DNS resolution between containers.
The default bridge network has limitations: no automatic DNS, all containers connect by default, and limited configuration. User-defined bridges provide DNS, isolation, and control. This is a Docker best practice.
DNS Resolution
On user-defined networks, Docker provides DNS resolution. Containers can reach each other by name. You can also create DNS aliases for load balancing and flexible service discovery.
# Create network
docker network create backend
# Run multiple instances of a service
docker run -d --name api1 --network backend myapp
docker run -d --name api2 --network backend myapp
# DNS resolves to all IPs (round-robin)
docker run --rm --network backend alpine nslookup api1
# Use network aliases for flexible naming
docker run -d --name api-v1 --network-alias api myapp
docker run -d --name api-v2 --network-alias api myapp
# DNS resolves 'api' to both IPs
docker run --rm --network backend alpine nslookup apiNetwork aliases let multiple containers share a DNS name. Docker performs round-robin DNS resolution, distributing requests across all containers with the same alias.
Host Network
Host networking removes network isolation. The container shares the host's network namespace — it uses the host's IP address, ports, and interfaces. This provides the best network performance but eliminates port mapping and network isolation.
# nginx listens on port 80 on the host directly
docker run -d --network host nginx
# Access it at the host's IP
curl http://localhost:80
# No port mapping needed
# No -p flag works with host networking
docker run -d --network host -p 8080:80 nginx # ErrorHost networking is useful for performance-critical applications or when you need the container to see all host network interfaces. It is Linux-only — Docker Desktop does not support true host networking.
None Network
The none network disables all networking. The container has only a loopback interface. This is useful for batch processing, security-sensitive workloads, or containers that should never communicate over the network.
# Run a container with no network
docker run --rm --network none alpine ip addr show
# Only lo (loopback) interface
# Useful for batch jobs that don't need network
docker run --rm --network none mybatchjobA container on the none network cannot reach the internet, other containers, or the host. It has only the loopback interface (127.0.0.1).
Inspecting Networks
# List all networks
docker network ls
# Inspect a specific network
docker network inspect app-network
# See which containers are on a network
docker network inspect app-network --format '{{range .Containers}}{{.Name}} {{end}}'
# Connect a running container to a network
docker network connect app-network mycontainer
# Disconnect a container from a network
docker network disconnect app-network mycontainerdocker network inspect shows the network configuration, subnet, gateway, and connected containers. This is essential for debugging networking issues.
Always specify --network explicitly rather than relying on the default bridge. This makes your networking configuration explicit and gives you DNS resolution between containers.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.