Network Isolation

Look, if you've ever dealt with this in production, you know exactly what the problem is. We know containers isolate files (Namespaces) and limit RAM (cgroups). But they also isolate the Network. When you run a container, Docker generates a completely isolated virtual network interface for it. Container A cannot talk to Container B by default, even if they are running on the exact same laptop. This is a massive security feature. However, in modern microservices, an API *must* talk to a Database. We need a way to connect them. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. To allow them to communicate, we create a 'User-Defined Bridge Network'. A bridge network acts exactly like a virtual ethernet switch inside your laptop. You create it using docker network create my-net. Then, when you run your containers, you attach them to this specific switch using the --network flag. Once both containers are plugged into the same bridge, the isolation is breached, and they can talk to each other freely. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. Once they are on the same Bridge Network, how does the API actually find the Database? You shouldn't use IP addresses, because Container IP addresses change every time they reboot. The magic of User-Defined Bridge networks is 'Automatic DNS Resolution'. Docker runs an internal DNS server. If you name your database container --name my-db, the API container can literally just connect to the URL http://my-db. Docker automatically resolves the name to the correct internal IP. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Network Isolation. We know containers isolate files (Namespaces) and limit RAM (cgroups). But they also isolate the Network. When you run a container, Docker generates a completely isolated virtual network interface for it. Container A cannot talk to Container B by default, even if they are running on the exact same laptop. This is a massive security feature. However, in modern microservices, an API *must* talk to a Database. We need a way to connect them.

User-Defined Bridge Networks. To allow them to communicate, we create a 'User-Defined Bridge Network'. A bridge network acts exactly like a virtual ethernet switch inside your laptop. You create it using docker network create my-net. Then, when you run your containers, you attach them to this specific switch using the --network flag. Once both containers are plugged into the same bridge, the isolation is breached, and they can talk to each other freely.

If you want an API container and a Database container to be able to send HTTP requests to each other, what must you do?

• →Create a User-Defined Bridge Network using docker network create, and launch BOTH containers using the --network flag to plug them into it.
• →Use the -p flag to expose both containers to the public internet.

Automatic DNS Resolution. Once they are on the same Bridge Network, how does the API actually find the Database? You shouldn't use IP addresses, because Container IP addresses change every time they reboot. The magic of User-Defined Bridge networks is 'Automatic DNS Resolution'. Docker runs an internal DNS server. If you name your database container --name my-db, the API container can literally just connect to the URL http://my-db. Docker automatically resolves the name to the correct internal IP.

Host and None Networks. Bridge is the standard, but there are two other important network modes. The none network (--network none) is an absolute quarantine. The container gets NO network interface at all. It cannot talk to the internet, and nothing can talk to it. It is perfectly isolated. The host network (--network host) does the exact opposite. It completely removes the network namespace barrier, binding the container directly to your laptop's physical ethernet adapter. It shares your exact IP.

You are building a microservices architecture. Your 'Payment Gateway' container MUST be able to reach the 'User Database' container. How does the Payment container reliably find the Database's IP address?

• →It doesn't need the IP. If both are on the same Bridge Network, the Payment container just connects using the Database container's --name. Docker's internal DNS translates it automatically.
• →The developer must hardcode the IP address 172.18.0.5 into the source code.

Connectivity Mastered. You have unlocked the ability to build complex microservices. You understand that containers are isolated by default, and that User-Defined Bridge networks act as virtual switches. By leveraging Docker's magical internal DNS, your containers can communicate effortlessly using human-readable names. Next, we will explore advanced network connectivity and port exposition techniques.