Networking & Ports
Containers on the same bridge network each get a private IP and find one another by service name alone. That network isn't visible outside the host, though, so reaching a container from outside means mapping a host port to a container port with something like `-p 8080:80`. Names on the inside, port mapping on the outside — telling those two apart is the whole point.
01Networking & Ports
Concept at a GlanceThree containers are up on the same bridge network. Each gets its own private IP.
A user-defined network has embedded DNS, so a container's name is its hostname. api reaches the database at db:5432 without knowing its IP.
IPs can change on restart; names don't. That's why config files carry service names, not addresses.
All of this is inside the host. The network isn't visible from outside.
To reach it from outside you map a host port to a container port with -p 8080:80. Requests pass through NAT to web:80.
Ports you don't map can't be reached from outside — the absence of an arrow is the absence of a route. Not publishing api and db is a first line of defence in itself.
Containers on a different network can't be reached even by name. Splitting networks is splitting isolation boundaries.
Try it yourself · Network
02 Understand It Simply
For EveryoneInside a user-defined network a container's name is its DNS name. Reaching it from outside requires mapping a host port to a container port; an unmapped port simply has no route.
Docker creates a bridge network and hands each container a private IP.
On a user-defined network the embedded DNS resolves container names, so you connect to `db:5432` by name.
External traffic arrives through port mapping (NAT) from host port to container port, and any port you didn't map simply can't be reached.
Containers on different networks can't reach each other even by name.
- –Wiring up microservice communication
- –resolving port conflicts
- –minimising external exposure
- –and tuning isolation by splitting networks
03 Frequently Asked Questions
FAQWhat is Networking & Ports?+
Containers on the same bridge network each get a private IP and find one another by service name alone. That network isn't visible outside the host, though, so reaching a container from outside means mapping a host port to a container port with something like `-p 8080:80`. Names on the inside, port mapping on the outside — telling those two apart is the whole point.
Where is Networking & Ports used?+
Wiring up microservice communication, resolving port conflicts, minimising external exposure, and tuning isolation by splitting networks.
What's a simple analogy for Networking & Ports?+
Inside a user-defined network a container's name is its DNS name. Reaching it from outside requires mapping a host port to a container port; an unmapped port simply has no route.