After this lesson, you will be able to: Understand Docker networking: bridge, host, container-to-container DNS, port publishing, and the common gotchas.
Most Docker bugs are networking bugs. This lesson explains the model so you can debug them in seconds.
Bridge (default): Docker creates a virtual switch on the host. Containers get IPs in a private subnet (172.x). Containers reach each other by name (Docker DNS); host reaches them only via published ports (`-p`). Host: container shares the host's network stack. No isolation; container's port 80 IS the host's port 80. Faster, less isolated; rare in production. None: no networking at all. Used for isolated processing jobs.
Instead of the default bridge, create your own.
docker network create my-app-netdocker run -d --name db --network my-app-net postgresdocker run -d --name web --network my-app-net -p 3000:3000 myapp# Inside web, you can reach db by name:# psql -h db -U postgres# Docker DNS resolves 'db' to the right IP.docker network ls # list networksdocker network inspect my-app-net # see who's on it
Without it, container IPs change on every restart. Hardcoding IPs is brittle. On a custom network (or Compose's default), Docker runs a tiny DNS server. Each container looks up other containers by name. Production lesson: never reference containers by IP. Always by name (Docker) or by service (Kubernetes).
`-p 8080:80` binds host:8080 to container:80. Anyone who can reach the host on 8080 can hit your container. `-p 127.0.0.1:8080:80` binds only to localhost, useful for dev to prevent external access. On a public VPS without a firewall, every `-p` exposes you to the internet. Pair Docker with UFW or a cloud security group. Common UFW gotcha: Docker bypasses UFW by default on Linux. Use Docker's own iptables-aware rules or run a reverse proxy.
Drop into a container and test what it can reach.
docker exec -it web sh# Inside the container:ping db # service name resolves?getent hosts db # explicit DNS lookupnc -zv db 5432 # can we connect on port 5432?wget -qO- http://other-service:8080 # actually fetch a URL# If the container image is slim and has no debugging tools:docker run --rm -it --network container:web nicolaka/netshoot# netshoot is a debugging image with curl, dig, nc, tcpdump, etc.# --network container:web joins the same network as the running 'web' container.
Trying to reach containers from the host by container IP. Use published ports. Hardcoding container IPs. Use service names. Trusting UFW to block Docker-published ports on Linux. Docker manipulates iptables directly. Publishing the same port twice (-p 8080:80 from two services). Second one fails to start. Forgetting that `docker network create` creates a network; containers must explicitly join. Old containers don't auto-join.
Pick the most common cause.
Sign in and purchase access to unlock this lesson.