Creating Custom Networks

The default bridge is like a shared hallway where every apartment in the building can see each other.

Custom networks are like private floors. You can create:

• Floor 3: Only the web app and database apartments
• Floor 5: Only the cache and worker apartments

Apartments on Floor 3 can’t even see that Floor 5 exists. They’re on separate networks.

And within each floor, there’s a directory (DNS) that lets you say “knock on ‘database’s door” instead of “knock on apartment 302.”

Create a custom network:

docker network create my-app-network

Docker creates a new bridge network named my-app-network.

View it:

docker network ls

You’ll see:

NETWORK ID     NAME              DRIVER    SCOPE
xxxxxxxxxxxx   my-app-network    bridge    local

Inspect it:

docker network inspect my-app-network

You’ll see it has its own subnet (like 172.18.0.0/16), different from the default bridge.

Start containers on this network:

docker run -d --name web --network my-app-network nginx
docker run -d --name db --network my-app-network mysql:8

Both containers are now on my-app-network, isolated from containers on other networks.

The key behavior: on custom networks, Docker provides automatic DNS.

Test it:

docker exec web ping -c 3 db

It works! The web container resolved db to the database container’s IP automatically.

How it works:

Docker runs an embedded DNS server at 127.0.0.11 inside each container on a custom network.

When a container tries to resolve a hostname:

1. The container queries 127.0.0.11
2. Docker’s DNS server checks if the hostname matches a container name on the same network
3. If yes, it returns that container’s IP
4. If no, it forwards the query to external DNS

View DNS config inside a container:

docker exec web cat /etc/resolv.conf

You’ll see:

nameserver 127.0.0.11
options ndots:0

The 127.0.0.11 is Docker’s embedded DNS.

Containers on different networks can’t reach each other.

Create two networks:

docker network create frontend-net
docker network create backend-net

Start containers on different networks:

docker run -d --name web --network frontend-net nginx
docker run -d --name db --network backend-net mysql:8

Try to reach db from web:

docker exec web ping db
# ping: db: Name or service not known

They can’t see each other. They’re on separate networks.

Connect a container to multiple networks:

docker network connect backend-net web

Now the web container is on both frontend-net and backend-net. It can reach containers on both networks.

---