Docker Networking
Prof. (Dr.) Vipul Dabhi
Department of Information Technology,
D. D. University
Communication among Containers
● Docker provides networking capabilities for containers to communicate with
each other.
Container 1 Container 2
(Front End) Networking
(Back End)
Docker
Host Machine / EC2 Instance
Isolation between Containers
● There can be a situation where containers need to be isolated from each
other.
Container 1 Container 2
(Login) (Payment)
Docker
Host Machine / EC2 Instance
Communication between Host and Container
● Every container need to communicate with host.
Container 1 Container 2
(Front End) (Back End)
Docker
Host Machine / EC2 Instance
Networking in VMs
● Containers do not have Operating System like Virtual Machine.
● In case of VM, we can run two applications in two different VMs. Each VM can
have a separate subnet address.
[Link] [Link]
Application 1 Application 2
Guest O.S. Guest O.S.
VM 1 VM 2
Networking
● In host machine, eth0 (default network) is available
● When we create a container, eth0 (default network) will get created.
● However, there is a difference between subnets of these two.
● If we try to ping Host IP from Container, we will get networking error.
Container 1 [eth0 : [Link]]
Not
possible
Host [eth0 : [Link]]
Bridge (Virtual) Network
● To solve this problem,
docker creates a virtual
network, which is also
known as docker 0.
● Without virtual network, a
container can not talk to
host.
● By default, when we
create a container, virtual
network, eth0 gets
created.
● This is called Bridge
Network.
Image source : [Link]
Bridge Network
● Container has a different subnet and Host has a different subnet.
● But using Bridge (Virtual Ethernet), container can communicate to host.
● It is a default network in Docker.
● If we delete or manipulate this Bridge Network then container can not
communicate with Host.
● Implication of deleting or manipulating Bridge Network
○ Our application runs inside the container. The container is inside the Host.
○ The end user is able to access the Host (through host network) and not container then the
application running inside the container is not reachable to end user.
○ The end user can not reach to the application through Internet.
● There are different ways through which container can communicate with host.
● The other options are
○ Host Network
Host Network
● The container will directly use the network of host.
● When we create a container, docker will directly bind the container with eth0
of Host.
○ If the IP address of host is [Link] then the IP address of container will be [Link].
○ IP addresses of both are in the same subnet.
● Therefore, by default, it is possible to ping host from container.
● The end user can directly access the application running inside the container
because host and container IP addresses are in the same subnet.
● However, this also raise the security issue. The primary reason for creating
container is containers are secure in nature.
Host Network
The container does not get
its own IP Address.
When a port is opened on
the container it causes the
same port to be opened on
the IP Address of the host
system.
Host network is supposed
to be faster then bridge
mode as there is no need
for DNS, NAT (Network
Address Translation)
Image Source: [Link]
Isolation between Containers
● Consider the use of Default Bridge Network (eth0) in this scenario. Here we
want to isolate containers from each other.
Container 1 Container 2
(Login) (Payment)
Docker
Host Machine / EC2 Instance
Bridge Network
● If we go with default bridge network, there is only one veth0 / docker0.
● Both applications (containers) will use the same bridge network (veth0) to
communicate with host.
● This provides a common path to the hacker.
● One container can communicate with other containers through veth0. All
containers can communicate with host using veth0.
Bridge Driver
When a new container that uses host
network is created, it is connected to
the docker0 interface using veth
(Virtual Ethernet Device).
Virtual Ethernet Device can be thought
of as a Ethernet cable that is
connected from a container to a
switch.
veth creates a virtual tunnel which
allows data to flow to and from the
container and docker0 interface. From
here the packets travels to the
network interface on the host system
from where the packets can reach the
internet.
Image Source: [Link]
Bridge Network
● Consider a situation where we want that one container should not talk to other
containers
● If two containers are : Frontend and Backend then they can communicate with
each other. But if two containers are : Login and Payment then the containers
should not communicate with each other. We want isolation in scenario 2.
● Using Host Network, we can not achieve isolation between containers
because all containers share same host network.
● The isolation can be achieved using Bridge Network. The Docker allows us to
create our custom bridge network.
Custom Bridge Network
● By default a container communicates with host using veth0.
● The docker allows creation of custom network. This helps us to split up the
network.
● As the Login container does not require security, it can use veth0 (default
bridge network) to communicate to host.
● Whereas the Payment container needs to be secure. Therefore, we will create
a custom bridge network for Payment container to communicate to host.
● This allows us to break the common path (which was available earlier to
hackers)
● Custom bridge network allows us to achieve logical isolation between
containers
Custom Bridge Network
Host
Login Payment
Eth0: [Link] Eth0: [Link]
veth veth
Docker 0 custom_bridge
eth 0: [Link]
● Consider the web application
● Content of Dockerfle
Create “login” Container from Image
Log into Container
Update
Create “Logout” Container
● By default “ping” utility is not available.
● Run the following command to install ping
● Open a new terminal / command prompt. Create another container : “logout”
● Find out number of containers available by running the command
Get the information of Login container
● Run the following command: docker inspect login
Get the information (IP Address) of Login container
Get the information of Logout container
● Run the following command: docker inspect logout
Get the information (IP Address) of Logout container
Communication Between Containers
● Because we use default bridge network, the IP addresses of both containers
are in the same subnet.
● Check whether one container (login) can communicate with other container
(logout). They can communicate with each other as they are using default
bridge network.
○ Type the following command (assuming we are already login into login container)
■ Ping [Link] (IP address of logout container)
● Type the following command to see all networks available on host
○ docker network ls
Create Custom Bridge Network
● Now we want to create “payment” container. Which is to be isolated from login
and logout containers.
● We need custom bridge network for isolation.
● Create custom bridge network with the following command. By default “docker
network create” command creates bridge network.
● Check network gets created or not using the following command
Create “Payment” container
● Assign custom bridge network to payment container.
● Check the number of containers running
Inspect “Payment” container
● Run the following command
○ docker inspect payment
Inspect “Payment” container
Ping “payment” container from “login” container
● Try to ping IP address of “payment” container from “login” container
● We will not be able to reach “payment” container from “login” container.
● Therefore, we can say that containers (“payment” and “login”) are isolated from
each other and “payment” container is secure.
Create Container using Host Network
● Create a container “hosttest” with the following command
● Check the container gets created
Inspect “hosttest” container
● Inspect “hosttest” container with the following command
Inspect “hosttest” container
● There is no IPAddress because it is binded with host IP address. Docker did
not create any virtual network.