Stage 4 · Provision

Networking, Storage & Compose Deep Dive

Bridge & Host Networking

Compare bridge, host, none, and user-defined networks with docker network inspect and DNS aliases.

8 min readDocker & ContainersProvision

Network Drivers

Docker supports multiple network drivers that determine how containers communicate with each other and the outside world. Each driver has different tradeoffs for isolation, performance, and complexity. Choosing the right driver is critical for production deployments.

Driver	Isolation	Performance	Use Case
bridge	Full (own IP stack)	NAT overhead	Default for single-host
host	None (shares host)	Best (no NAT)	Performance-critical
none	Complete	N/A	Security-sensitive
overlay	Cross-host	VXLAN overhead	Multi-host (Swarm)
macvlan	Own MAC address	Best	Legacy network integration

Bridge Networking

The bridge driver creates a Linux bridge on the host. Each container gets its own IP address on the bridge. Containers on the same bridge can communicate directly. Traffic to external networks goes through NAT. This is the default for single-host deployments.

Bridge network inspection


# List networks
docker network ls

# Inspect the default bridge
docker network inspect bridge

# Run a container on the bridge
docker run -d --name web nginx

# Check the container's IP
docker inspect web --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}'

# Containers on the default bridge cannot use DNS
docker run --rm alpine ping web  # Fails — no DNS resolution

The default bridge network provides basic networking but lacks DNS resolution between containers. Always use user-defined bridges for multi-container applications.

Host Networking

Host network behavior


# Container shares the host's network stack
docker run -d --network host nginx

# nginx listens on host port 80
curl http://localhost:80

# No port mapping — container uses host ports directly
docker run -d --network host -p 8080:80 nginx  # Error

# Check what's listening on the host
ss -tlnp | grep nginx

Host networking removes network isolation entirely. The container sees all host network interfaces and can bind to any port. This provides the best performance but eliminates port mapping and network isolation.

User-Defined Networks

Creating and using user-defined networks


# Create a custom bridge network
docker network create --driver bridge app-network

# Run containers on the network
docker run -d --name api --network app-network myapp
docker run -d --name db --network app-network postgres

# DNS resolution works
docker exec api ping db  # Success

# Network options
docker network create \
  --driver bridge \
  --subnet 172.20.0.0/16 \
  --gateway 172.20.0.1 \
  my-network

User-defined bridges provide automatic DNS resolution, configurable subnets, and network isolation. Containers on different user-defined networks cannot communicate unless explicitly connected.

DNS Aliases

DNS alias configuration


# Create network
docker network create backend

# Run multiple instances with the same alias
docker run -d --name api-v1 --network-alias api --network backend myapp:v1
docker run -d --name api-v2 --network-alias api --network backend myapp:v2

# DNS resolves 'api' to both IPs (round-robin)
docker run --rm --network backend alpine nslookup api

# Inspect DNS resolution
docker exec api-v1 cat /etc/resolv.conf
# nameserver 127.0.0.11 — Docker's embedded DNS

DNS aliases enable service discovery and load balancing. Multiple containers can share a DNS name. Docker's embedded DNS server (127.0.0.11) handles resolution.

Inspecting Networks

Network inspection commands


# List all networks with details
docker network ls --format "table {{.ID}}	{{.Name}}	{{.Driver}}	{{.Scope}}"

# Inspect a specific network
docker network inspect app-network

# See connected containers
docker network inspect app-network --format '{{range .Containers}}{{.Name}} {{end}}'

# Connect a running container to a network
docker network connect app-network mycontainer

# Connect with an alias
docker network connect --alias db-replica app-network mycontainer

# Disconnect from a network
docker network disconnect app-network mycontainer

docker network inspect shows the network's subnet, gateway, IPAM config, and connected containers. Use --format to extract specific fields for scripting.

Use user-defined bridges for everything

The default bridge network is limited: no DNS, no isolation between containers, and limited configuration. User-defined bridges provide DNS resolution, network isolation, and configurable options. This is a fundamental Docker best practice.

Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.