Docker Networking Basics
Docker networking is ordinary networking in miniature: the default bridge network is a virtual switch on the host, containers get private IPs behind NAT, and -p 8080:80 is just a port-forwarding rule. If you know NAT and VLANs, you already understand this.
The five network types
| Network type | What it does | Use when |
|---|---|---|
bridge (default) | Private network on the host; containers NAT out | Single-host apps |
host | Container shares the host's network stack directly | Max performance, no isolation |
none | No networking at all | Security / custom setups |
overlay | Virtual network spanning multiple hosts | Swarm/multi-host services |
macvlan | Container gets its own MAC/IP on the LAN | Container must look like a physical host |
The default bridge, in familiar terms
Docker creates docker0 — a virtual switch. Each container gets a private IP (typically 172.17.0.0/16) on that switch and reaches the internet through PAT on the host, exactly like PCs behind a home router. Publishing a port —
docker run -p 8080:80 nginx # host:8080 → container:80
— is a DNAT rule: traffic hitting the host on 8080 forwards to the container's 80, the same port forwarding you would configure on any router.
Container DNS and user-defined networks
Create your own network and containers resolve each other by name via Docker's embedded DNS:
docker network create appnet docker run -d --name db --network appnet postgres docker run -d --name web --network appnet myapp # can reach "db" by name
User-defined networks also isolate groups of containers from each other — think of each as its own VLAN.
Why network engineers should care
Modern apps ship in containers, so "the network" increasingly extends inside hosts — and troubleshooting means following a packet through NAT rules and virtual switches you now recognise. It pairs naturally with Linux skills and cloud work, where the same concepts appear as VPCs and security groups.
Frequently asked questions
How does Docker networking work by default?
Containers join a bridge network (docker0) — a virtual switch on the host. Each gets a private IP and reaches outside networks through NAT on the host, like PCs behind a home router.
What does docker run -p 8080:80 do?
It publishes a port: a NAT (port-forwarding) rule that sends traffic arriving on the host's port 8080 to the container's port 80.
What is the difference between bridge and host networking?
Bridge gives the container its own private IP behind NAT (isolated). Host mode shares the host's network stack directly — faster, but no network isolation and possible port conflicts.
How do containers talk to each other by name?
Put them on the same user-defined network — Docker's embedded DNS then resolves container names to their IPs automatically.
Related articles
Want hands-on training?
Learn this on real Cisco lab devices with placement support at Attila Technologies, Ahmedabad.