Base de Conhecimento

Understanding Docker's networking model is essential once you're running more than a single standalone container — especially for letting containers (like a web app and its database) talk to each other securely.

The Default Network Types

Bridge (Default)

Each container gets its own internal IP on a private virtual network created by Docker. This is the default mode for containers started without an explicit network.

docker network ls

Host

The container shares the host machine's network stack directly — no port mapping needed, but also no network isolation.

docker run --network host nginx

None

The container has no network access at all — useful for isolated batch/processing jobs.

docker run --network none myimage

Why Custom Networks Matter

Containers on the same custom (user-defined) bridge network can reach each other by container name, with automatic DNS resolution — no need to hardcode IP addresses.

Creating a Custom Network

docker network create app-network

Connecting Containers to It

docker run -d --name db --network app-network mysql:8.0
docker run -d --name web --network app-network -p 80:80 myapp

From inside the web container, the database is reachable simply as db:

mysql -h db -u root -p

Networking in Docker Compose

Compose automatically creates a dedicated network for each project, and every service can reach the others by service name — no manual network setup required:

services:
  web:
    image: myapp
    depends_on:
      - db
  db:
    image: mysql:8.0

Inside web, the database host is simply db (the service name).

Exposing Ports vs Publishing Ports

EXPOSE in a Dockerfile is documentation only. Actually making a port reachable from outside the container requires -p (publish):

docker run -p 8080:80 nginx

This maps host port 8080 to the container's internal port 80.

Inspecting a Container's Network Settings

docker inspect CONTAINER_NAME | grep IPAddress

Common Errors

Containers can't reach each other by name — they're likely on different networks (e.g. one on the default bridge, one on a custom network). Put them on the same network.

Port already published elsewhere — check what's already using the host port:

sudo ss -tulpn | grep :8080

Best Practices

• Use custom networks (or Compose's automatic per-project network) instead of relying on hardcoded container IPs
• Only publish ports that genuinely need to be reachable from outside the host
• Use host networking sparingly — it removes container network isolation

FAQ

Do containers on the same Compose project need explicit network configuration?
No — Compose automatically creates a shared network for all services in the same project, and DNS-based service discovery works out of the box.

Related Articles

• Deploy Your First Docker Container
• Run MySQL/PostgreSQL/Redis in Docker Containers
• Docker Security Best Practices