Chapter 74: DevOps Projects Part 4: Docker Scan, Network, Logging and Swarm
74.2 Project 28: Docker networking lab (bridge, host, custom)
Friends, containers that cannot find each other waste hours. Today we compare the default bridge, create a user-defined network with DNS names, publish a port, and practice disconnect and reconnect.
मित्रांनो, एकमेकांना न सापडणारे containers तास वाया घालवतात. आज default bridge, user-defined network DNS, port publish, disconnect-reconnect.
दोस्तों, एक-दूसरे को न मिलने वाले containers घंटे बर्बाद करते हैं. आज default bridge, user-defined network DNS, port publish, disconnect-reconnect.
What you will build in this project
- Default bridge listed.
- Custom shopnet with name DNS.
- Published nginx on 8091.
- disconnect/reconnect proof.
1. Start from a real company story
At Swiggy in Bengaluru, two microservices used hardcoded 172.17 addresses. A daemon restart renumbered IPs and broke checkout for 12 minutes.
Rough cost: about ₹9 lakh in refunds and coupons.
Neha moved the stack to a user-defined bridge with service DNS names.
Today we practice that networking lab.
Ravindra Bagale's Tip
Many students use --network host for every API. Prefer a user-defined bridge and published ports. Keep that habit.
खूप students प्रत्येक API साठी --network host वापरतात. User-defined bridge आणि published ports. सवय ठेवा.
बहुत students हर API के लिए --network host इस्तेमाल करते हैं. User-defined bridge और published ports. आदत रखिए.
2. Start and prepare
Step 1: Default bridge check
Why: Know the default. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: docker network ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 1: ls
Type this:
docker network ls
You will see:
NETWORK ID NAME DRIVER SCOPE
What it means: List.
Example 2: bridge
Type this:
docker network ls --filter name=bridge --format '{{.Name}} {{.Driver}}'
You will see:
bridge bridge
What it means: Default.
Example 3: inspect gw
Type this:
docker network inspect bridge --format '{{(index .IPAM.Config 0).Gateway}}'
You will see:
172.17.0.1
What it means: Gateway.
Step 2: Run two containers
Why: Need peers. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: docker run. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 4: a
Type this:
docker rm -f net-a net-b >/dev/null 2>&1; docker run -d --name net-a alpine:3.20 sleep 3600 && echo a_up
You will see:
a_up
What it means: A up.
Example 5: b
Type this:
docker run -d --name net-b alpine:3.20 sleep 3600 && echo b_up
You will see:
b_up
What it means: B up.
Example 6: ps
Type this:
docker ps --filter name=net- --format '{{.Names}}'
You will see:
net-a
net-b
What it means: Both.
Step 3: Inspect IP
Why: IPs change. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: inspect IPAddress. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 7: ip a
Type this:
docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' net-a
You will see:
172.17.0.2
What it means: IP A.
Example 8: ip b
Type this:
docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' net-b
You will see:
172.17.0.3
What it means: IP B.
Example 9: note
Type this:
echo 'IPs on the default bridge are not stable DNS names for each other'
You will see:
IPs on the default bridge are not stable DNS names for each other
What it means: Limit.
3. Build the main pieces
Step 4: Custom bridge network
Why: Custom nets get DNS names. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: network create. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 10: create
Type this:
docker network rm shopnet >/dev/null 2>&1; docker network create shopnet && docker network ls --filter name=shopnet --format '{{.Name}} {{.Driver}}'
You will see:
shopnet bridge
What it means: Custom.
Example 11: inspect
Type this:
docker network inspect shopnet --format '{{.Name}} {{.Driver}}'
You will see:
shopnet bridge
What it means: OK.
Example 12: subnet
Type this:
docker network inspect shopnet --format '{{(index .IPAM.Config 0).Subnet}}'
You will see:
172.18.0.0/16
What it means: Subnet.
Step 5: Connect services by name
Why: Names beat IPs. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: --network name. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 13: recreate
Type this:
docker rm -f net-a net-b >/dev/null; docker run -d --name net-a --network shopnet alpine:3.20 sleep 3600; docker run -d --name net-b --network shopnet alpine:3.20 sleep 3600; echo on_shopnet
You will see:
on_shopnet
What it means: Both on shopnet.
Example 14: ping
Type this:
docker exec net-a ping -c 1 net-b
You will see:
1 packets transmitted, 1 received
What it means: Name DNS.
Example 15: rev
Type this:
docker exec net-b ping -c 1 net-a
You will see:
1 packets transmitted, 1 received
What it means: Reverse.
Step 6: Host network note
Why: Host shares the stack. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: --network host. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 16: host note
Type this:
echo 'docker run --network host ... shares the host network namespace'
You will see:
docker run --network host ... shares the host network namespace
What it means: Host.
Example 17: when
Type this:
echo 'Use host networking rarely; prefer published ports'
You will see:
Use host networking rarely; prefer published ports
What it means: Care.
Example 18: none
Type this:
echo 'docker run --network none alpine:3.20 for fully isolated labs'
You will see:
docker run --network none alpine:3.20 for fully isolated labs
What it means: None.
4. Automate and verify
Step 7: None network note
Why: None isolates. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: --network none. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 19: none demo
Type this:
docker rm -f net-none >/dev/null 2>&1; docker run -d --name net-none --network none alpine:3.20 sleep 3600; docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' net-none; echo isolated
You will see:
isolated
What it means: No IP.
Example 20: rm none
Type this:
docker rm -f net-none >/dev/null; echo cleaned
You will see:
cleaned
What it means: Clean.
Example 21: prefer
Type this:
echo 'Prefer user-defined bridge for multi-container apps'
You will see:
Prefer user-defined bridge for multi-container apps
What it means: Rule.
Step 8: Publish ports
Why: Publish reaches host. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: -p. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 22: publish
Type this:
docker rm -f net-web >/dev/null 2>&1; docker run -d --name net-web --network shopnet -p 8091:80 nginx:1.27-alpine && curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8091/
You will see:
200
What it means: Published.
Example 23: port
Type this:
docker port net-web
You will see:
80/tcp -> 0.0.0.0:8091
What it means: Map.
Example 24: from peer
Type this:
docker exec net-a wget -qO- http://net-web/ | head -c 20
You will see:
<!DOCTYPE html>...
What it means: Internal by name.
Step 9: Disconnect and reconnect
Why: Reconnect for moves. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: disconnect/connect. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 25: disconnect
Type this:
docker network disconnect shopnet net-b && echo disconnected
You will see:
disconnected
What it means: Off net.
Example 26: fail ping
Type this:
docker exec net-a ping -c 1 -W 1 net-b || echo unreachable
You will see:
unreachable
What it means: Expected.
Example 27: reconnect
Type this:
docker network connect shopnet net-b && docker exec net-a ping -c 1 net-b
You will see:
1 received
What it means: Back.
5. Harden and accept
Step 10: DNS inside network
Why: DNS is built in. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: ping by name. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 28: dns
Type this:
docker exec net-a nslookup net-b 2>/dev/null | tail -3 || docker exec net-a getent hosts net-b
You will see:
... net-b
What it means: Resolver.
Example 29: embed
Type this:
echo 'User-defined bridges embed DNS for container names'
You will see:
User-defined bridges embed DNS for container names
What it means: Feature.
Example 30: compose
Type this:
echo 'Compose creates a project network automatically'
You will see:
Compose creates a project network automatically
What it means: Compose.
Step 11: Cleanup networks
Why: Delete unused nets. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: network prune. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 31: rm web
Type this:
docker rm -f net-web net-a net-b >/dev/null; echo stopped
You will see:
stopped
What it means: Stop.
Example 32: rm net
Type this:
docker network rm shopnet && echo removed
You will see:
removed
What it means: Net gone.
Example 33: prune tip
Type this:
echo 'docker network prune removes unused networks'
You will see:
docker network prune removes unused networks
What it means: Prune.
Step 12: Acceptance checklist
Why: Neha signs off when name DNS works. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the scan or network is healthy today.
What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams harden containers.
Example 34: ping worked
Type this:
echo name_dns_ok
You will see:
name_dns_ok
What it means: Proof.
Example 35: prefer bridge
Type this:
echo user_defined_bridge
You will see:
user_defined_bridge
What it means: Choice.
Example 36: Sign-off
Type this:
echo 'Neha: PASS'
You will see:
Neha: PASS
What it means: Done.
Check yourself
Q1. Who fixed Swiggy IPs?
Neha
Q2. Custom net name?
shopnet
Q3. Ping proof?
ping net-b
Q4. Host port lab?
8091
Q5. Isolate network?
none
Q6. Compose creates?
project network
Friends, you proved container DNS on a custom bridge. Did you understand? Let us try it once more. Rebuild the three-tier Compose lab and inspect its project network name.
मित्रांनो, तुम्ही custom bridge वर container DNS सिद्ध केले. three-tier Compose lab पुन्हा चालवून project network पाहा.
दोस्तों, आपने custom bridge पर container DNS सिद्ध किया. three-tier Compose lab फिर चला project network देखें.
Lab: try at home
- List networks.
- Create shopnet.
- Run two alpine containers.
- ping by name.
- Publish nginx and curl.
Recap
- Default bridge has weak DNS for peers.
- User-defined bridge embeds DNS.
- Host networking is rare.
- -p publishes to the host.
- Prune unused networks.