Networks

# 1) List networks
docker network ls
# NETWORK ID   NAME     DRIVER   SCOPE
# abc123       bridge   bridge   local
# def456       host     host     local
# ghi789       none     null     local

# 2) Create a user-defined bridge network — preferred over the default bridge
docker network create app-net
docker network create --driver bridge --subnet 10.0.42.0/24 --gateway 10.0.42.1 app-net

# 3) Run containers on the network — they get automatic DNS by name
docker run -d --name db    --network app-net postgres:16
docker run -d --name web   --network app-net myapp:1.0

# Inside web: connect to 'db:5432' — Docker DNS resolves 'db' to db's IP.
# (Default 'bridge' network does NOT do name resolution between containers.)

# 4) Connect a running container to another network
docker network connect monitoring web
docker network disconnect monitoring web

# 5) Inspect — IPs, gateway, attached containers
docker network inspect app-net
# Use jq to extract:
docker network inspect app-net --format '{{json .Containers}}' | jq

# 6) Host networking — share the host's network stack
docker run -d --network host nginx
# - Container binds to host ports directly (no -p mapping)
# - Faster (no NAT), less isolated
# - Use for high-throughput proxies, monitoring agents
# - Linux only (limited on Docker Desktop)

# 7) None — no network at all (security or batch jobs)
docker run --rm --network none alpine ip addr
# Only loopback. Useful for offline tasks.

# 8) Port publishing — bridge needs explicit mapping
docker run -d -p 8080:80 nginx                 # host:container
docker run -d -p 127.0.0.1:8080:80 nginx       # bind only to localhost
docker run -d -p 8080:80/tcp -p 8080:80/udp nginx

# 9) Compose — networks declared per service
services:
    web:
        image: myapp:1.0
        networks: [front, back]
    db:
        image: postgres:16
        networks: [back]
    proxy:
        image: nginx:1.27
        ports: ['80:80']
        networks: [front]
networks:
    front: {}
    back:  { internal: true }    # 'internal: true' = no internet egress

# 10) Internal networks (Compose) — DB unreachable from outside
networks:
    db-only:
        internal: true
# Containers on db-only can talk to each other but NOT to external IPs.

# 11) Multi-host networking — overlay (Swarm) / CNI (Kubernetes)
docker swarm init
docker network create -d overlay --attachable my-overlay
# Containers on different nodes can talk via 'my-overlay'.

# Kubernetes uses CNI plugins (Calico, Cilium, Flannel) — same concept, richer policy.

# 12) Network policies (firewall rules)
# Pure Docker: limited (use --internal for outbound block)
# Swarm: ingress + egress policies via labels
# Kubernetes: NetworkPolicy resources gate traffic by Pod label + namespace

# 13) Debug DNS + connectivity
docker run --rm --network app-net alpine sh -c 'apk add bind-tools && nslookup db'
docker run --rm --network app-net alpine ping -c 3 db
docker exec -it web nc -zv db 5432

# 14) Inspect a container's networking
docker exec web ip addr
docker exec web ip route
docker exec web cat /etc/resolv.conf

# 15) Common patterns
# Public-facing app                : nginx (proxy network) → app (proxy + back) → db (back, internal)
# Microservices                     : per-service network for related groups; shared mesh for tracing/metrics
# CI / batch                        : --network none for sandbox; --network host for high-perf network tests
# Local dev                         : compose with shared 'app-net' so all services discoverable by name

# 16) Things to avoid
#   • Using the default 'bridge' network (no DNS between containers — use a named bridge)
#   • --network host for a regular app (loses isolation, port conflicts)
#   • Hardcoding container IPs (use the service name; IPs change on restart)
#   • Forgetting --network on `docker run` — container ends up on 'bridge' alone, can't reach the rest of the stack

docker network create my-net
docker run -d --net my-net --name db  postgres:16
docker run -d --net my-net --name api my-api