Docker Networking for Enterprise Applications

Understanding Docker's networking models is essential for production-grade containerized applications.

Network Driver Overview

Driver	Use Case	Scope
bridge	Single-host containers	Local
host	Performance-critical apps	Local
overlay	Multi-host Swarm/K8s	Swarm/cluster
macvlan	Containers need real IPs	Local
none	Isolation	Local

Custom Bridge Networks

BASH

# Create isolated network
docker network create --driver bridge   --subnet 172.20.0.0/16   --ip-range 172.20.240.0/20   --gateway 172.20.0.1   --opt "com.docker.network.bridge.name"="br-app"   app-network

# Run containers on network
docker run -d --network app-network --name web nginx
docker run -d --network app-network --name api myapi

# Containers can reach each other by name
docker exec web curl http://api:8080/health

Docker Compose Multi-Network

YAML

version: '3.8'

services:
  nginx:
    image: nginx:alpine
    networks:
      - frontend
    ports:
      - "443:443"

  api:
    image: myapp:latest
    networks:
      - frontend
      - backend

  postgres:
    image: postgres:15
    networks:
      - backend
    environment:
      POSTGRES_PASSWORD: secret

networks:
  frontend:
    driver: bridge
    ipam:
      config:
        - subnet: 172.21.0.0/24
  backend:
    driver: bridge
    internal: true  # No external access
    ipam:
      config:
        - subnet: 172.22.0.0/24

Macvlan for Real IP Assignment

When containers need to appear as real hosts on the LAN:

BASH

docker network create -d macvlan   --subnet=192.168.10.0/24   --gateway=192.168.10.1   --opt parent=eth0   macvlan-net

docker run -d --network macvlan-net   --ip 192.168.10.100   --name db postgres:15

Network Security

BASH

# Disable ICC (inter-container communication) on default bridge
dockerd --icc=false

# Or in daemon.json
cat > /etc/docker/daemon.json << EOF
{
  "icc": false,
  "iptables": true,
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" }
}
EOF

Monitoring Container Network

BASH

# Container network stats
docker stats --format "table {{.Name}}	{{.NetIO}}	{{.BlockIO}}"

# Inspect network
docker network inspect app-network