Docker Networking: Bridge, Host, Overlay & Compose

# Create a user-defined bridge network
docker network create app-network

# Run containers on the network
docker run -d --name api --network app-network node:22-slim
docker run -d --name db --network app-network postgres:17

# The 'api' container can now reach 'db' by name
# From inside 'api': ping db → resolves to the container's IP

# Inspect the network (see connected containers, subnet, gateway)
docker network inspect app-network

# Disconnect a container from the network
docker network disconnect app-network api

# Remove the network (must disconnect all containers first)
docker network rm app-network

# Map host port 8080 → container port 3000
docker run -p 8080:3000 myapp

# Map to a specific host interface (localhost only)
docker run -p 127.0.0.1:8080:3000 myapp

# Map a range of ports
docker run -p 8000-8010:8000-8010 myapp

# Let Docker pick a random host port
docker run -p 3000 myapp
# Check assigned port: docker port <container_id>

# UDP port mapping
docker run -p 5353:53/udp dns-server

# Multiple port mappings
docker run -p 80:80 -p 443:443 nginx

# Container name = DNS name (on user-defined networks)
docker run -d --name redis --network app-network redis:7

# From another container on the same network:
# redis:6379 resolves to the container's IP

# Network aliases — multiple DNS names for one container
docker run -d --name redis-primary \
  --network app-network \
  --network-alias redis \
  --network-alias cache \
  redis:7

# Both 'redis' and 'cache' resolve to this container

# Debug DNS resolution
docker run --rm --network app-network alpine nslookup redis

services:
  api:
    image: node:22-slim
    ports:
      - "3000:3000"
    networks:
      - frontend
      - backend
    depends_on:
      - db
      - redis

  web:
    image: nginx:latest
    ports:
      - "80:80"
    networks:
      - frontend
    # 'web' can reach 'api' but NOT 'db' or 'redis'

  db:
    image: postgres:17
    environment:
      POSTGRES_PASSWORD: secret
    networks:
      - backend
    volumes:
      - pgdata:/var/lib/postgresql/data

  redis:
    image: redis:7
    networks:
      - backend

networks:
  frontend:
    driver: bridge
  backend:
    driver: bridge
    internal: true  # No external access — db/redis isolated

volumes:
  pgdata:

# Initialize Swarm (required for overlay networks)
docker swarm init

# Create an attachable overlay network
docker network create -d overlay --attachable multi-host-net

# Deploy a service across multiple nodes
docker service create \
  --name api \
  --network multi-host-net \
  --replicas 3 \
  myapp:latest

# Standalone containers can also join (with --attachable)
docker run -d --name debug --network multi-host-net alpine sleep 3600

# Inspect overlay network
docker network inspect multi-host-net

# List all networks
docker network ls

# Inspect a network (shows connected containers, IPs, subnet)
docker network inspect app-network

# Check which networks a container is connected to
docker inspect --format='{{json .NetworkSettings.Networks}}' my-container

# Test connectivity from inside a container
docker exec -it api ping db
docker exec -it api curl http://api:3000/health

# Run a temporary debug container on the network
docker run --rm -it --network app-network nicolaka/netshoot
# Inside: dig redis, nslookup db, curl api:3000, tcpdump, etc.

# Check published ports
docker port my-container

# View iptables rules Docker created (Linux)
sudo iptables -t nat -L -n | grep DOCKER