Network Troubleshooting

Look, if you've ever dealt with this in production, you know exactly what the problem is. You created a User-Defined Bridge network, attached an API and a Database, but the API still says 'Connection Refused'. How do you figure out what went wrong? The Docker CLI provides powerful inspection tools. The docker network inspect <name> command dumps the internal state of the virtual switch, showing you the exact IP addresses, the subnet mask, and a list of every single container currently plugged into it. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. If inspect shows both containers are plugged in, but the API still fails, you must verify that the internal DNS is actually working. You do this by physically breaching the API container using docker exec -it api sh, and then running the ping command from INSIDE the API, targeting the Database container by name. If the ping succeeds, the network is perfect, and the bug is in your JavaScript/Python code. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Look, if you've ever dealt with this in production, you know exactly what the problem is. Troubleshooting isn't just about fixing broken connections; it's about fixing dangerous ones. By default, when you publish a database port using docker run -p 5432:5432, Docker binds that port to 0.0.0.0. This means your database is publicly accessible to anyone on your local Wi-Fi (or the public internet if on a cloud server). This is a critical security vulnerability for local development. This isn't just academic theory—understanding the *why* behind this is what separates junior devs from senior engineers. When you deploy to a cluster, this is the mechanic that prevents catastrophic failure.

Network Troubleshooting. You created a User-Defined Bridge network, attached an API and a Database, but the API still says 'Connection Refused'. How do you figure out what went wrong? The Docker CLI provides powerful inspection tools. The docker network inspect <name> command dumps the internal state of the virtual switch, showing you the exact IP addresses, the subnet mask, and a list of every single container currently plugged into it.

Pinging Across the Void. If inspect shows both containers are plugged in, but the API still fails, you must verify that the internal DNS is actually working. You do this by physically breaching the API container using docker exec -it api sh, and then running the ping command from INSIDE the API, targeting the Database container by name. If the ping succeeds, the network is perfect, and the bug is in your JavaScript/Python code.

Your Node.js API cannot connect to your Postgres container. You run docker network inspect and verify they are both on the exact same network. You exec into the Node container, run ping postgres, and it successfully replies. What does this mean?

• →It means Docker's networking and DNS are working perfectly. The bug must be in your application code (e.g., wrong password, wrong port, or bad connection string).
• →It means Docker's network is broken and needs to be restarted.

Network Security (Binding). Troubleshooting isn't just about fixing broken connections; it's about fixing dangerous ones. By default, when you publish a database port using docker run -p 5432:5432, Docker binds that port to 0.0.0.0. This means your database is publicly accessible to anyone on your local Wi-Fi (or the public internet if on a cloud server). This is a critical security vulnerability for local development.

Secure Localhost Binding. To secure your local development environment, you must explicitly bind the published port to 127.0.0.1 (your laptop's secure localhost adapter). By running docker run -p 127.0.0.1:5432:5432, you instruct the Docker firewall to only accept traffic originating from your physical machine. Attackers on the coffee shop Wi-Fi are physically blocked at the Kernel level from even seeing the port.

You are building an app in a cafe. You need to connect DBeaver (a desktop app) to your Dockerized Postgres database. How should you publish the port to ensure the person sitting next to you cannot connect to it?

• →Use -p 127.0.0.1:5432:5432 to bind the port strictly to your private localhost loopback adapter.
• →Use -p 5432:5432 and assume Docker will protect you.

Diagnostics Mastered. You have added Network Diagnostics to your skillset. You can inspect virtual bridges to verify container attachments, use exec ping to validate internal DNS resolution, and secure your bindings to prevent unauthorized access. The CLI commands are powerful, but typing -p, -v, and --network for 5 different containers is exhausting. Next, we leave the CLI behind and discover Docker Compose.