Custom Networks and Container Isolation
Creating a custom network
Section titled “Creating a custom network”Use docker network create with --driver bridge to create a named network. The bridge driver is the default, so you can omit it for brevity:
docker network create --driver bridge frontend-netConnecting containers at run time
Section titled “Connecting containers at run time”Attach a container to a custom network with --network at start time:
docker run -d --name nginx-proxy --network frontend-net nginx:alpineConnecting a running container to an additional network
Section titled “Connecting a running container to an additional network”A running container can be added to another network without restarting it:
docker network connect backend-net mycontainerAfter this, mycontainer has interfaces on both frontend-net and backend-net and can communicate with containers on either network.
Disconnecting a container from a network
Section titled “Disconnecting a container from a network”docker network disconnect frontend-net mycontainerThe container loses its interface on frontend-net but keeps any other network connections.
Inspecting a custom network
Section titled “Inspecting a custom network”docker network inspect frontend-netThe output shows the driver, subnet, gateway, and a Containers map listing every attached container with its IP and MAC address.
Isolation in practice
Section titled “Isolation in practice”Network segmentation is a zero-cost security control. Containers on different networks cannot reach each other unless explicitly connected to both.
A typical three-tier application uses three separate networks:
| Network | Containers attached | Can reach |
|---|---|---|
frontend-net | nginx-proxy, web-app | Each other only |
backend-net | web-app, api-server | Each other only |
data-net | api-server, postgres | Each other only |
web-app is connected to both frontend-net and backend-net, so it bridges the two tiers. postgres is on data-net only — the nginx proxy cannot reach the database directly, even if compromised.
Listing networks
Section titled “Listing networks”Filter docker network ls by driver to see only bridge networks:
docker network ls --filter driver=bridgeRemoving a network
Section titled “Removing a network”A network cannot be removed while containers are attached to it. Stop and remove the containers first, then remove the network:
docker network rm frontend-netHands-on: isolation between networks
Section titled “Hands-on: isolation between networks”# Create two networks
docker network create frontend-net
docker network create backend-net
# Start a container on frontend-net only
docker run -d --name frontend --network frontend-net alpine sleep 300
# Start a container on backend-net only
docker run -d --name backend --network backend-net alpine sleep 300
# Show isolation: frontend cannot reach backend by name
docker exec frontend ping -c 1 backend || echo "Isolated: frontend cannot reach backend"
# Connect frontend to backend-net so it can reach both
docker network connect backend-net frontend
# Now frontend can reach backend
docker exec frontend ping -c 3 backend
# Inspect the networks
docker network ls --filter driver=bridge
# Cleanup
docker stop frontend backend && docker rm frontend backend
docker network rm frontend-net backend-net