Docker Day 8: Enabling Container-to-Container Communication with Networks and Service Names

Default network modes

bridge

: default network; containers attach to this bridge; suitable for single‑host container communication. host: container shares the host’s network stack directly; useful for performance‑sensitive scenarios. none: disables networking for the container, providing complete isolation; used when high security is required.

Container‑to‑container communication via IP

# Start two containers
docker run -d --name app1 nginx:alpine
docker run -d --name app2 nginx:alpine

# Show their IP addresses
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' app1   # 172.17.0.2
docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' app2   # 172.17.0.3

# Ping from app1 to app2 (ping must be installed in the image)
docker exec app1 ping -c 1 172.17.0.3

IP addresses change after a container restart, making direct IP usage inconvenient.

Service names instead of IP (automatic DNS)

In Docker Compose, the service name becomes the hostname.

services:
  api:
    build: .
    environment:
      - DB_HOST=db
  db:
    image: postgres:16-alpine

Docker embeds a DNS server at 127.0.0.11 that resolves db to the current container IP.

# Python example
import os
db_host = os.getenv("DB_HOST")  # "db"
# Docker automatically resolves this to the container IP

Custom networks

Compose creates a default bridge network, but you can define additional networks for isolation.

services:
  frontend:
    build: ./frontend
    networks:
      - webnet
  backend:
    build: ./backend
    networks:
      - webnet
      - dbnet
  db:
    image: postgres:16-alpine
    networks:
      - dbnet

networks:
  webnet:
    driver: bridge
  dbnet:
    driver: bridge
    # external: true  # uncomment if using an external network

Network isolation: frontend can reach backend but cannot connect directly to db.

Improved security for more complex topologies.

Port mapping

Expose container ports on the host:

# Host 8080 → container 80
docker run -d -p 8080:80 nginx:alpine

# Multiple ports
docker run -d -p 80:80 -p 443:443 nginx

# Random host ports for all EXPOSEd ports
docker run -d -P nginx

docker‑compose.yml port mapping

services:
  api:
    ports:
      - "8000:8000"          # host 8000 → container 8000
      - "127.0.0.1:8001:8001" # restrict access to localhost

Containers accessing the host

macOS / Windows: use host.docker.internal as the host address.

Linux: use 172.17.0.1 (the default bridge gateway) or add an entry with --add-host.

services:
  api:
    environment:
      DB_HOST: host.docker.internal  # macOS/Windows
      # For Linux, add:
      # extra_hosts:
      #   - "host.docker.internal:172.17.0.1"

Network troubleshooting

# Inspect container network details
docker inspect app1 | grep -A 20 Networks

# List containers attached to a specific network
docker network inspect bridge | grep Containers

# Test connectivity between containers
docker exec app1 nc -zv app2 5432

# Capture packets for deeper analysis
docker exec app1 tcpdump -i eth0

Day 8 summary

Containers on the same network communicate via service names; Docker’s embedded DNS resolves names to current IPs.

Port mapping ( -p host:container) exposes container services to external traffic.

The default bridge network created by Docker Compose is sufficient for many simple setups.

Custom bridge networks provide isolation for more complex scenarios.