Docker Networking Explained: A Practical 2026 Guide

Описание и применение

Создание пользовательских сетей Docker обеспечивает DNS, изоляцию и предсказуемое сопоставление портов, устраняя большинство проблем с сетевыми взаимодействиями контейнеров.

Задача

Containers on the same host cannot communicate by name, services expose ports unintentionally, and default bridge networking lacks DNS and isolation.

Результат

Adopting user‑defined networks, internal isolation, and explicit port binding eliminates most networking headaches, ensuring services communicate correctly and remain secure.

Рабочий процесс

• Create a user‑defined bridge network: docker network create --driver bridge --subnet 172.20.0.0/16 mynet
• Run containers on that network: docker run -d --name app --network mynet nginx
• Verify DNS resolution inside containers: docker exec -it app nslookup db 127.0.0.11
• Use Docker Compose to auto‑create a project network and reference services by name
• Configure internal networks for databases: set internal: true to block external access
• Bind exposed ports to localhost (-p 127.0.0.1:5432:5432) or add rules to DOCKER-USER chain
• Use host networking only for latency‑critical or multicast‑dependent services
• For LAN IPs, create a macvlan network and add a shim interface if host needs to communicate with the container

Доказательства

Containers in one project that cannot talk, a service that answers curl locally but not from a laptop, a database port open to the internet even though UFW blocks it, and host mode copied from a tutorial without knowing what it gives up.

Источник

The default bridge has no DNS between containers, so you cannot reach one by name.

Источник

Publishing a port is DNAT, and Docker writes its own rules into the DOCKER and DOCKER-USER iptables chains, ahead of your regular firewall rules.

Источник