Introduction to Container Networking in Docker

Most containerized applications need some form of communication with other network devices and applications. This is where container networking concepts play an important role. In this blog, we will tell you everything you need to know about container networking and how to get started on it.

We will be covering most of the container networking concepts on Docker, as it is one of the most common platforms for running containers. But these concepts will be similar across many container platforms.

Let’s start by understanding the type of networking options available in Docker and the difference between them.

Types of Container Networking

Docker containers connect to other devices in the network via the host. This is done by creating a layer of software-defined network (SDN) over the host. Other devices do not even need to know that they are connected to a Docker container. 

The networked devices can be on any platform and host. There is no special setup needed to network Docker containers across Linux, Mac, or Windows systems.

Below are the types of networks that can be set in a Docker container: 

Bridge network

Docker creates a default bridge network named docker0 when it is installed. Every container is part of this bridge network unless otherwise specified. This is a virtual Ethernet bridge that can send packets across all the devices in the network. 

Docker also creates two other networks called host and none

“host” ensures that there is no isolation between the host and the containers within it. So for the outside world, all of them are on the same network. 

“none” ensures that the containers attached to the bridge run a container-specific network stack. 

OekBQo4Vbr44yhrNHuSo L8fgrWXQ7iMDxl sqs3OdJt17GF8xL726m v A3LqABXPsYCWj7cNRhnBqVb34lMxgPvAV9vTrY21bCMeKxaZbrHTF BCiLYskq5UeMeVRnCh93VkpOvUX

All containers on a host are connected to each other on this internal network. All containers are added to the namespace of the host. This assigns a private IP address/subnet to the bridge.

If you wish to communicate with any of the containers on the bridge network from the outside world, you will need to do port mapping with the host. 

For example, say a web service container running on port 80 needs to be accessed from the outside world. For this, a free port on the host, say 8080 for example, needs to be mapped to port 80 of the container.

You can also create your own bridge network with a “docker network create” command. 

Q4A71HPIUx7hAB6Q2AUhgjic Azdxc krC cgbeDaO8RcXxGk

-d flag tells the kind of network driver to use while creating the custom network. In this case, it is a “bridge” network with the name “my_bridge”. You can list all the networks on the host with the “docker network ls” command.

IDOjed2SSTOSldyhDteQKbInIulkaJL6QHDftrYcHNygHRL 9 t4HN5MUPNc1MMeWEVOGqVJxWv9cHhMI422F7YNfpc1LxKybx4GzT7n7BCY0PaQxvk1zFmfj3jh AmztbRQ05Im3JfvvVBRFU9YQWwR9VC4Qf7 irEI B8vZLaM1HH9qhY

To attach the container to your custom bridge network instead of default “docker0”, run the below command when you start the container:  

N6jTD27Nq5jhOMbbfa5X85vJYauMGZPR5NzITBtbeO31IwZ7A1u6YYe8iX2kPN0UJTbTwshxW2RHuOcv1coSNYhENcyciI7JuQSrRcgNpAiwpvBs WtWBX7VVymvx2g3f84cNzmXOii1fPVD8eJ iZXlilXVKupzXhirs2eNfHCLgK3Zl I

Our network would now look like this:

1OIGFgANcDmfAbTldV6JYwnnbgRipMzG WLABGLyJK7dE7QhBjU3K3npqjgEuwti93BH7Tw1W3GPkMibOGGRD 8vEAQIEPvetzS pchEo AvsSQZnnJ8DgcA2RTgfevMCOu1Z 2SpV2ftK21Mk96XXQ89AU0jFuZaeLTaaK4tgQI3fNgWNk

“veth” means virtual ethernet. 

If you wish to connect a running container to a new bridge network, you can do that by “docker network connect” command.

For example, if you wish to connect the container “web” to the new bridge network “my_bridge”. 

GF bmN70dnznWE nfQN7foP1tacmdaMM62VmMV7f2D9cFJG6JIBQW6EyjO3Y8qhqXqsfeQBcIwvWPYasN2GrLB22E C q9zx7cYm3Tw8PhxpYqzue

With this, our network would now have the container web connected to two bridge networks: docker0 and my_bridge.

ko1IB7z3P7nVYqLxjPJ D uO4OSpuORs5NM7t1auHOaD52nPMiN95eg7jDq1RldLEVQOyPJjYJvD8nBePFkSs8Ftt2ZhJObJ6Uvv0SRDyvfm8rXg8A0MNoT9vDtYwczWCcQ8 ympFo2o J37JaxO6 g TaBv 6ugWxwqBveYNZQ4Xts5f Y

If you wish to read more about bridge networking, you can read in the Docker documentation.

Host network

As discussed in the previous section, Docker creates a “host” network which helps make the container and host seen as the same device for the outside world. This makes it easy to communicate with all the network devices. 

While the host network driver allows no isolation between the host and container from a networking standpoint, it also allows for isolation for storage, process namespace, and user namespace.

For example, say you want to connect your Nginx container to the host machine port to access it directly from the host machine’s IP address. Assuming port 80 (nginx’s default port) is free on host, the following command will remove the container-host isolation:

TKqj6cwNtzuPA3jh95NMD5P42V9SgQeAeDsu5DFpwPZ9 EilcGVrE9Y 4pKhpSVG3uwqQg9CzDCul50oQA jeYc KV0l2nExR8pZEWCfYqVZIRwL rf4YxUUWVrnoNbQi9dg08WNMWDasDY o8Wv5YRiajsWHjeMv8d3wdyw7yBMg tj6rY

–rm option makes Docker remove the container once it stops. 

-d flag is to run the container in detached format. 

–network mentions the kind of network being set up. 

my_nginx is the local name given to the nginx container.

This command will enable you to access Nginx on the host with http://localhost:80/

You can read more about host networking in Docker’s documentation.

Overlay network

Docker has a container orchestration service called Docker Swarm. In this setup, multiple containers (called workers) are managed by a central manager container. This allows you to create, manage and destroy containers automatically as per the resource requirements. 

With an overlay network, you can connect multiple docker daemons and allow swarm services to communicate with each other. It creates a distributed network that sits on top of host-specific networks. 

Similar to bridge networks, you can create your own custom overlay network with “docker network create” command.

s6m0BA81F5O0T h15KrfG6c1ByCLYu3kUXqhUcbloMMakqcGYYbKAwp1mCO3 T1Bnt1W tF0GSJMtoZPBrB81wX1X2dyETjIVkkNrtUXLYy mApoDtnsDjAGcdQciM4PY4dDZir8ySyyXFzmAYiEot1RolrlAh8EV1ywhPYSGNDp7MD9G1c

The above command would create an overlay network named pets-overlay with an encrypted communication channel. Next, we need to attach docker containers to the network. 

spyobg8FnR0Ek5NzvnAcWIZZX3B3scZIkXUuGHxo6SzhQYwj3OkyauX46LgP OU7zHG8cvUs2o0YLpI24ZTfCitsp9Zn8mjPOn9Y4dpqNu1lOievgHpXJeSBsmWUt0R1igFce69nsr9dY3ggD XdiCfvN aBR2MGDlU3C0XcEiwBob4ULkY
39tG31qJmd7Q1ROI4brv0NDZhggOcISKNNPKNaCfa6Olgmx77MaocXGk60lVynU1YSYBWzO53WoYkc8jaAgzWK2OKOdk8dcQ4xtAL

The above two commands will help deploy a web application on port 8000 across multiple hosts and using a Redis database. Docker swarm helps load balance the traffic to be able to scale quickly. 

x1pADHtUNeahxx8YiXJqxugjMf9UHhLgMZyt0n m oJFvl0h76qIbiBI3VojU9hljjnukFM5knj cQzvXifJQqlkLfW3Tyfhushu3xApRRvxSrOxk3aO0xRwyitWJwo5lti sK3quBWtpB 26KVpkMVLSdOSMKz8C7777af4H8Dld2 Xbk

You can read more about overlay networks from the Docker documentation.

IPvlan network

IPvlan drivers are used when you want complete control over IPv4 and IPv6 addressing. The network driver gives total control of layer 2 VLAN tagging and IPvlan L3 routing for underlay network integration.

IPvlan requires Linux kernel v4.2+. Let’s us see an example of IPvlan L2 mode. 

d05ogXGS1KR mzqPoXJkIguHDTavxRGAuSvS1USuxTWHkG9E4Aw9pj35TaPXiaPBv58j2Rc80Mc AhKo5yRm8733eDEQrrIt8Df7mmrlmM3WqpmMSfm31iu11anyU6BqWWiXNCjxhfeU EvNaHVmwPnYU5 K Xx

The above “docker network create” command sets a L2 IPvlan and uses the host’s interface network as a –subnet. The default mode for IPvlan is L2. –gateway uses the first usable address in the network as the gateway. 

In the above example, since the subnet is 192.168.1.0/24, the gateway is its first usable address i.e., 192.168.1.1. 

Architecturally, the network would look something like this:

JeOt6Cs6SVLbnP9RoSGMVdINSmKhfxEcXCKmiQXnRZlbaaICSEAhWIStrkIJ4c17Um8a0gTR28VpA17yqlWCGkEcEH1eynUg gkjQvTpJ6uCW6rIupLy2R8 UIn4G0XkW6 X SrSWeP2U0fSm56JnyXPiXSP tvWX0cnq8zSNCk4yfr8Rq8

You can learn more about IPvlan networking from Docker documentation.

Macvlan network

Macvlan network driver allows assigning a MAC address to a container. This helps in making the container look like a physical device in a network. Some of the legacy applications require a direct connection to the physical network rather than being routed through the Docker host’s network stack. 

With a macvlan network, the Docker host accepts requests for multiple MAC addresses on its IP address and then routes them to appropriate containers. Macvlan networks only work with Linux hosts with kernel v4.0+. 

There are two ways to set up a macvlan network: bridged macvlan network or 802.1q trunked macvlan network.

Let us see an example of creating a macvlan bridged network:

pXvc7njAlACOXb3uCCuBH16jCxvqjGUyGaK2gK0PmDHope6 EioMxCRW4O9LmlMUObvxuYHykQtrTEPYw8Lxp2gUneo0Fvj6gZZcq5iS8N FnUSRVYSsahohixL4ec sAMistATgWEIhGHRdxtajwdL aDgppqxw4S89

The above command will create a bridge macvlan with the name my-macvlan-net. To see if the command ran successfully, you can run a “docker network ls” command to see the list of networks.  

You can also run a “docker network inspect my-macvlan-net” command to verify the newly created macvlan network. 

If you wish to learn more about the Macvlan network, check out the Docker documentation.

How to Disable networking in a container

There are occasions when you may wish to disable all networking in a container. You can do so with the option “–network none” in the docker command. Here is a sample command to create a container with networking disabled. 

zIrj lQUdbHL0AZRfnnLEZygYdliKl3XxNQ9wTTT87sLvSBT7KfgqogpcBmvCyM2TJpIeD8D5AHmRNYBYM5bD7nbPD6sHUcPrCgOtZBo3hI

–rm option ensures the container is removed when it is stopped. 

Using third-party network plugins

Docker also allows you to create your own custom network plugin. Some of the popular ones include Contiv, Kuryr, and Weave network plugins. Make sure you look at the vendor’s documentation before installing any of them. 

SFu3dRdDY1QSN5lP99pFx4

You can read more about network plugins in Docker here.

Useful Docker networking commands

Let us now see some of the useful commands that you will need to get around with Docker networking. Some of these you have already seen in the previous sections. All commands discussed here are child commands of the “docker network” command. 

docker network ls

List all the networks available in the Docker ecosystem. ls command has many options, but a simple command will show a result similar to this:

f4sJJ0MJqqQYQKb2pyML NVo1BDh0DAPamX2Jj4kANtnTWO7FGnyBb6xDEJHCvZy802EHjTTYufZp768RIvpDyIlJubkDoiQ4KzzR2TmPwY 0X aE2KJRSr 6H15kbCwjsYGZ38K yeJHWW gvxumVt7ZfVyQpS6T

docker network create

This command helps create a new custom network in the docker ecosystem. 

dFS PgrWK29Tme8OzpL03z15jkDj8VuhtA aVCUhgWl9IXjcagrUZpYs 4Ljcb107P9tVai69z88e3RGa45SbMZDsl35oQG2AISohwPgVqAROoPKc6ckiOuzDCJtXrFzEeZACoLkq8bToWMBMLv8sL5KY NEl15Bra cLdkt4BE1FCDXcjA

The above command will create a bridge network named my-bridge-network.

docker network connect

This command helps connect a container to any existing network in Docker ecosystem. The below command will connect container1 to a network to a network named multi-host-network.

T4gWJhDogMVJHOjAsQJ4Q6ywSAB7TnUfcrfEau8shMCq5CJA7U9wRBVwUZcSPKIDU wduQm6SaS9VYrUaEDaK8GYo4E3bAurSnkA2a6nAhV0xfCLU1zPWzYD9A2qxN0XemTS6rEc7xBT sQNKSY6ZwUyRU0mhSyJpMFg6EKPNdlz GZly7I

docker network disconnect

Use this command to disconnect a container from a network. Continuing our previous example, the below command will disconnect container1 from multi-host-network.

aky3m4ZL0r6dsgB0nojHZhZMHwyudpeAf9s gS3fxkwZbLffvvwqvIVBBXyWivQT icLEQzdWQq U4B07HcaSuDqFvskJl9sei9h

docker network inspect

This command helps get detailed information on any network in JSON format. 

oBxukR4VH7eJjV48IrJ7BccC0NZpW5Ax60OYCj0xmZcXR1AV8W9igXUWGLSo3UaViKEF3ki7komtR1V5Detl2HKcwpc4cV43579q0m7yq6FgpKA vLSnEqYrpsqQIUgUQTjXhVQ2ziUH yfrRgvWs1HBf1OXJyl1o7wr2dCSQEsmntPiZ0I

docker network prune

The prune command helps remove all unused networks. By unused, we mean any network that is not being used by even one container.  

HqWRXSFkzW RKFtAILHCmpxXu IT9DAlZ5ZMpe2VZAf3DRCJPKEJvSTgJlbFN1KR9VZ5rrmeNf0joEGYF3yqR1pzK6aF GKHDeVPpR9FJlNCR85DZFEjTWKkCDXZSlOswkNbp6tcS2P5K0lNMbKGDvSA6rP7ZpihJS4 c2JR3T2CZBIpK I

docker network rm

If you wish to remove just one network from the Docker ecosystem, rm command is of use. For example, below command will remove the network my-network.

CbIZegOwUVfaMWvwcce1mDbGw5clc s LCg7UsjbHrNzjw4YWKn1ygy5yxD7GQI0qZhjFWBWL6T7TkX57GClNZYWLPuNnBJ6xXNK6UpT3slYbGXw1ga4Y4mHZ wfj roWKyG kMWeG

Here is a summary of the basic networking commands we discussed:

E38vT0mkgdwyga51DEmjOr p yTZCKJ9770o317fItuZuZ1 1hyhXoCC eFyGdC2W Mei 7qcJnRqNjhPO TjeEABl

Taikun: Automate Container management

Now that you understand the basics of container networking, you will inevitably also need a tool to manage multiple containers deployed across your infrastructure. This is called Container orchestration. Taikun provides a singular intuitive dashboard to manage containers in your network deployed across any private, public, or hybrid cloud. 

It supports all major cloud services like Amazon AWS, Microsoft Azure, Google Cloud, and RedHat Open Shift.

Try it now for FREE         Schedule a call with us