Docker Networking Guide: Bridge, Overlay & Host Network Modes

Docker Network Drivers Comparison

Bridge Networking (Default)

Bridge is the default driver. Docker creates a virtual bridge interface (docker0) on the host. Each container in the network gets an IP from the bridge subnet (typically 172.17.0.0/16).

# Create a user-defined bridge network (enables container DNS)
docker network create --driver bridge myapp-network

# Run containers on the named network
docker run -d --name api --network myapp-network myapi:latest
docker run -d --name db --network myapp-network postgres:16

# From 'api' container, reach 'db' by name:
# psql -h db -U postgres   ← DNS resolves 'db' to container IP

# Port mapping: host:container
docker run -d -p 8080:80 --network myapp-network nginx

Docker Compose Networking

Compose automatically creates a default bridge network for each project. Services communicate using their service names as DNS hostnames.

services:
  frontend:
    image: nginx
    ports:
      - "80:80"
    networks:
      - frontend-net

  api:
    image: myapi:latest
    networks:
      - frontend-net   # Reachable from frontend as 'api'
      - backend-net    # Reachable from db layer

  db:
    image: postgres:16
    networks:
      - backend-net    # Only accessible from api, NOT frontend

networks:
  frontend-net:
    driver: bridge
  backend-net:
    driver: bridge

This pattern isolates the database from the frontend — frontend cannot reach db because they share no common network. Defense in depth even within Docker.

Network Inspection Commands

# List all Docker networks
docker network ls

# Inspect a network (see containers, subnet, gateway)
docker network inspect myapp-network

# See which networks a container is connected to
docker inspect api --format '{{json .NetworkSettings.Networks}}'

# Connect a running container to another network
docker network connect backend-net api

# Disconnect
docker network disconnect frontend-net api

# Remove unused networks
docker network prune

Host Networking for Performance

Host networking removes Docker's NAT layer. The container uses the host's network stack directly. Zero port-mapping overhead — useful for high-performance services or network monitoring tools.

# Run with host networking (Linux only — not supported on Docker Desktop macOS/Windows)
docker run -d --network host nginx

# Container listens directly on host port 80
# No -p flag needed (or possible)

# Verify: container's network interfaces = host interfaces
docker exec -it my-container ip addr

Note: Host networking only works on Linux. Docker Desktop on macOS/Windows runs containers inside a Linux VM, so host networking connects to the VM's network, not the macOS/Windows host.