Docker Network Reference

docker network create --driver bridge <name>

Default driver. Containers on the same bridge can communicate via IP. Ideal for single-host setups.

docker run --network host <image>

Container shares the host network stack directly. No network isolation, but maximum performance.

docker network create --driver overlay <name>

Multi-host networking for Docker Swarm. Spans across multiple Docker daemons with VXLAN encapsulation.

docker network create --driver macvlan --subnet=<cidr> -o parent=<iface> <name>

Assigns a MAC address to each container, making it appear as a physical device on the LAN.

docker network create --driver ipvlan --subnet=<cidr> -o parent=<iface> <name>

Similar to macvlan but all containers share the parent MAC address. Lower overhead, no promiscuous mode needed.

docker run --network none <image>

Completely disables networking for the container. Only the loopback interface is available.

docker network ls

List all Docker networks on the host, showing driver, scope, and ID.

docker network inspect <name>

Show detailed JSON configuration of a network including connected containers and IPAM config.

docker network create [OPTIONS] <name>

Create a new network with a specified driver, subnet, gateway, and options.

docker network rm <name>

Delete a network. Fails if any containers are still connected.

docker network connect <network> <container>

Attach a running container to an additional network. Containers can be on multiple networks.

docker network disconnect <network> <container>

Detach a container from a network. Use -f to force-disconnect a running container.

# (automatic) <project>_default

Docker Compose creates a default bridge network named <project>_default. All services join it automatically.

networks: <name>: driver: bridge

Define custom networks in Compose for service isolation and grouping.

networks: <name>: external: true

Reference a pre-existing Docker network instead of creating a new one.

services: svc: networks: net: aliases: [alias1]

Give a service additional DNS names on a specific network.

networks: net: ipam: config: - subnet: <cidr>

Configure IP address management: custom subnet, gateway, and IP range in Compose.

services: svc: networks: net: ipv4_address: <ip>

Assign a fixed IP to a container in a Compose network. Requires IPAM subnet config.

ping <container-name>

Docker provides an embedded DNS server (127.0.0.11) for user-defined networks. Containers resolve each other by name.

docker run --network-alias <alias> ...

Multiple containers with the same network alias enable basic round-robin DNS-based load balancing.

docker run --dns <ip> ...

Override the container DNS server. Useful for corporate DNS or local resolvers.

docker run --dns-search <domain> ...

Set a DNS search domain so short hostnames are automatically suffixed.

docker run --add-host <host>:<ip> ...

Add custom host-to-IP mappings to the container /etc/hosts file.

<service-name> resolves to container(s)

In Compose, each service name is automatically resolvable as a hostname by other services on the same network.

docker run -p <host>:<container> ...

Map a host port to a container port. Accepts TCP (default) and UDP.

docker run -P ...

Publish all ports declared with EXPOSE in the Dockerfile to random high-numbered host ports.

docker run -p <ip>:<host>:<container> ...

Bind a published port to a specific network interface by IP address.

docker run -p <start>-<end>:<start>-<end> ...

Map a range of host ports to a range of container ports.

services: svc: ports: - "<host>:<container>"

Declare port mappings in a Compose file. Supports short and long syntax.

EXPOSE <port>[/<proto>]

Documents which ports the container listens on. Does NOT publish the port — use -p or -P at runtime.

docker network create --internal <name>

Create a network with no outbound internet access. Containers can communicate only with each other.

docker network create --opt encrypted --driver overlay <name>

Enable IPsec encryption on overlay network traffic between Swarm nodes.

(separate networks per tier)

Place frontend, backend, and database containers on separate networks. Only shared services bridge tiers.

docker network create -o com.docker.network.bridge.enable_icc=false <name>

Disable inter-container communication on a bridge network. Containers can only reach the gateway.

-o com.docker.network.bridge.enable_ip_masquerade=true

Enable or disable NAT for outbound traffic from containers. Enabled by default on bridge networks.

"userland-proxy": false (daemon.json)

Disable the docker-proxy process for published ports. Uses iptables/nftables directly for better performance.

docker inspect -f '{{.NetworkSettings.Networks}}' <ctr>

Show the network configuration of a running container including IP, gateway, and connected networks.

docker exec <ctr> ping <target>

Ping another container or host from within a container to test DNS resolution and connectivity.

docker exec <ctr> netstat -tlnp

List open TCP ports inside a container. Use ss if netstat is unavailable.

docker exec <ctr> nslookup <hostname>

Verify DNS resolution inside a container. Check that the embedded DNS at 127.0.0.11 is working.

docker network prune

Remove all unused networks. Helps clean up after stopped Compose projects.

docker run --net=container:<target> tcpdump ...

Attach a debug container to another container network namespace for packet capture.

-o com.docker.network.driver.mtu=<value>

Set the Maximum Transmission Unit for a network. Required in environments with non-standard MTU (e.g. cloud VPNs).

docker network create --ipv6 --subnet=<cidr> <name>

Enable IPv6 on a Docker network. Requires daemon-level IPv6 to be enabled.

-o com.docker.network.bridge.name=<name>

Set the Linux bridge device name for a Docker bridge network.

docker network create --label <key>=<value> <name>

Attach metadata labels to a network for filtering and organisation.

docker network create --attachable --driver overlay <name>

Allow standalone containers (not just Swarm services) to attach to an overlay network.

--subnet <cidr> --ip-range <cidr> --gateway <ip>

Fine-grained IPAM: restrict the allocatable IP range within a larger subnet.