DOCKER - 15 Virtual-Networks

Now that we understand Docker networking concepts and how virtual networks and IPs work, let's go through the command-line options that manage them. The starting point is docker network ls to list networks, while docker network inspect shows the details of a specific network. The create command builds a new virtual network and accepts an optional --driver flag for built-in or third-party drivers. Finally, connect and disconnect add or remove a network interface on a running container — much like plugging a NIC into a powered-on computer.

Listing and inspecting networks

Running docker network ls shows every network that exists. Depending on your OS and Docker version, you'll see the bridge network called docker0 or bridge — both refer to the same default network connecting Docker's NAT firewall to your physical host. With an Nginx container running, docker network inspect bridge lists the attached containers (our webhost Nginx for instance), their IPs, and the IPAM configuration. The default subnet is usually 172.17.0.0/16, which can be customised, along with the gateway that routes traffic to the physical network.

Two other built-in networks deserve a mention. The host network bypasses Docker's virtual networking and attaches the container directly to the host interface — useful for high-throughput scenarios, but it weakens the isolation guarantees. The none network gives a container an interface attached to nothing, like an unplugged NIC.

  • docker network create my_app_net — create a bridge network
  • docker container run -d --name new_nginx --network my_app_net nginx — attach at creation
  • docker network connect my_app_net webhost — hot-plug an existing container
  • docker network disconnect my_app_net webhost — unplug it

Creating my_app_net uses the default bridge driver, allocating the next subnet (around 172.18.0.0/16, then 19, 20, etc.). Advanced features like overlay networks for multi-host private networking, or third-party drivers such as Weave, will be covered later. The docker network create --help output reveals every IP and driver option available for advanced scenarios.

You can switch containers between networks at runtime. After connecting our existing webhost to my_app_net, docker container inspect webhost will list two interfaces — one on the bridge network, one on my_app_net with a fresh IP. Disconnecting brings it back to a single network. The big benefit is security: by grouping app containers into a private virtual network and exposing only the necessary ports with -p, you drastically reduce the attack surface compared to a flat physical network. Multi-host networking will be addressed when we cover Docker Swarm.

Summary

This lesson introduces Docker virtual networks, explaining how containers communicate and isolate from each other. It covers the three main network drivers—bridge (default), host, and none—and demonstrates essential commands like `docker network ls`, `docker network inspect`, and `docker network create` to manage custom networks. The lesson also shows how to dynamically connect and disconnect containers to networks using `docker network connect` and `docker network disconnect`, enabling secure communication across isolated network subnets.

Key points

  • Docker automatically assigns IP addresses to containers on virtual networks using IPAM, with the default bridge network using the 172.17.x.x subnet range
  • The three network drivers serve different purposes: bridge (default, isolated local networks), host (direct interface access, bypassing containerization security), and none (no network connection)
  • Containers can be connected to a network at creation time using the --network flag, or dynamically connected/disconnected from existing networks with docker network connect and docker network disconnect
  • docker network inspect reveals all containers attached to a network and their assigned IP addresses, along with IPAM configuration details
  • Creating custom networks with docker network create provides better isolation and security than using the default bridge network when running multiple applications
  • Virtual networks allow you to safely run multiple applications on a single Docker host by using different network interfaces with separate IP ranges and automatic isolation

FAQ

What is the difference between the bridge and host network drivers?

The bridge driver creates an isolated virtual network with its own subnet and automatically manages IP addresses, providing containerization security. The host driver bypasses Docker's virtual networking entirely, attaching the container directly to the physical network interface, which offers better performance but without the security protections of containerization.

Can a container be connected to multiple networks at the same time?

Yes. You can connect a container to multiple networks, giving it multiple network interfaces with different IP addresses. This is similar to adding multiple ethernet cards to a physical computer, allowing the container to communicate on different network subnets simultaneously.

How does Docker automatically assign IP addresses to containers?

Docker uses IPAM (IP Address Management) configuration for each network, which automatically allocates IP addresses from the network's subnet range and configures a gateway for routing traffic to the physical network.