Debugging network issues in Docker - Step-by-Step Execution

Process Flow - Debugging network issues

Start: Identify network problem

↓

Check container network status

↓

Ping test between containers

↓

Inspect Docker network settings

↓

Check firewall and host network

↓

Fix configuration or restart network

↓

Verify connectivity restored

↓

End

This flow shows the step-by-step process to find and fix network problems in Docker containers.

Execution Sample

Docker

docker network ls

docker exec container1 ping -c 3 container2

docker network inspect bridge

docker network disconnect bridge container1

docker network connect bridge container1

docker exec container1 ping -c 3 container2

This sequence lists networks, tests connectivity, inspects network details, reconnects a container, and retests connectivity.

Process Table

Step	Command	Action	Result	Notes
1	docker network ls	List all Docker networks	Shows default and user networks	Confirms networks exist
2	docker exec container1 ping -c 3 container2	Ping container2 from container1	3 packets transmitted, 3 received	Connectivity OK at start
3	docker network inspect bridge	Inspect default bridge network	Shows containers connected and settings	Check IPs and links
4	docker network disconnect bridge container1	Disconnect container1 from bridge	No output	Simulate network issue
5	docker exec container1 ping -c 3 container2	Ping container2 from container1	3 packets transmitted, 0 received, 100% packet loss	Connectivity lost
6	docker network connect bridge container1	Reconnect container1 to bridge	No output	Restore network connection
7	docker exec container1 ping -c 3 container2	Ping container2 from container1	3 packets transmitted, 3 received	Connectivity restored

💡 Connectivity restored after reconnecting container1 to the bridge network

Status Tracker

Variable	Start	After Step 4	After Step 6	Final
container1 network connection	Connected to bridge	Disconnected from bridge	Reconnected to bridge	Connected to bridge
ping result	Success (3/3)	Fail (0/3)	Not tested	Success (3/3)

Key Moments - 3 Insights

Why does ping fail after disconnecting container1 from the bridge network?

Because container1 is no longer connected to the network that container2 is on, so it cannot reach container2. See execution_table step 5.

Why do we inspect the bridge network before disconnecting?

To confirm which containers are connected and their IP addresses, helping to understand the network setup. See execution_table step 3.

What confirms that the network issue is fixed?

The ping command succeeds again after reconnecting container1 to the bridge network. See execution_table step 7.

Visual Quiz - 3 Questions

Look at the execution table, what is the ping result at step 5?

A 3 packets transmitted, 3 received

B 3 packets transmitted, 0 received, 100% packet loss

C No packets transmitted

D Ping command not run

💡 Hint

Check the 'Result' column for step 5 in the execution_table.

At which step is container1 disconnected from the bridge network?

A Step 2

B Step 3

C Step 4

D Step 6

💡 Hint

Look at the 'Command' and 'Action' columns to find when disconnect happens.

If container1 was not reconnected at step 6, what would be the ping result at step 7?

A 3 packets transmitted, 3 received

B 3 packets transmitted, 0 received, 100% packet loss

C Ping command would fail to run

D Ping would succeed partially

💡 Hint

Refer to the ping result at step 5 when container1 was disconnected.

Concept Snapshot

Debugging Docker network issues:
1. List networks with 'docker network ls'.
2. Test connectivity using 'docker exec <container> ping <target>'.
3. Inspect network details with 'docker network inspect <network>'.
4. Disconnect and reconnect containers to fix issues.
5. Verify connectivity restored by pinging again.

Full Transcript

This visual execution shows how to debug network issues in Docker. First, we list networks to confirm their presence. Then, we test connectivity between containers using ping. We inspect the network to understand container connections. Next, we simulate a network problem by disconnecting a container from the network, causing ping to fail. Finally, we reconnect the container and verify that connectivity is restored by a successful ping. Variables like container network connection and ping results change accordingly, helping us track the problem and fix.

Practice

1. What is the primary Docker command to list all networks and check their status?

easy

A. docker ps -a

B. docker container ls

C. docker network ls

D. docker inspect network

Solution

1. Step 1: Identify the command to list networks

   The command docker network ls lists all Docker networks and their status.

2. Step 2: Differentiate from container commands

   docker container ls and docker ps -a list containers, not networks. docker inspect network is incomplete and incorrect syntax.

3. Final Answer:

   docker network ls -> Option C

4. Quick Check:

   List networks = docker network ls [OK]

Hint: Use 'docker network ls' to see all networks quickly [OK]

Common Mistakes:

• Confusing container list commands with network commands
• Using incomplete or wrong inspect syntax
• Trying to check networks with 'docker ps'

2. Which command syntax correctly runs a ping test inside a running container named webapp?

easy

A. docker exec webapp ping -c 4 google.com

B. docker run webapp ping google.com -c 4

C. docker exec -it ping webapp google.com

D. docker ping exec webapp google.com

Solution

1. Step 1: Understand the purpose of docker exec

   docker exec runs commands inside an existing container. The syntax is docker exec [container] [command].

2. Step 2: Check the correct ping command format

   ping -c 4 google.com sends 4 ping packets. docker exec webapp ping -c 4 google.com uses correct syntax. Options A, B, and C misuse docker run or command order.

3. Final Answer:

   docker exec webapp ping -c 4 google.com -> Option A

4. Quick Check:

   Run ping inside container = docker exec [container] ping [options] [OK]

Hint: Use 'docker exec <container> ping -c 4 <host>' to test connectivity [OK]

Common Mistakes:

• Using 'docker run' instead of 'docker exec' for existing containers
• Incorrect order of command arguments
• Missing '-c' option for ping count

3. You run docker network inspect bridge and see containers connected with IPs. What does this output tell you?

medium

A. It shows which containers are connected to the default bridge network and their IP addresses.

B. It lists all running containers and their CPU usage.

C. It displays the Docker daemon logs for network errors.

D. It shows the firewall rules blocking container traffic.

Solution

1. Step 1: Understand 'docker network inspect bridge'

   This command shows detailed info about the 'bridge' network, including connected containers and their IPs.

2. Step 2: Differentiate from other outputs

   It does not show container CPU usage, daemon logs, or firewall rules. Those require other commands.

3. Final Answer:

   It shows which containers are connected to the default bridge network and their IP addresses. -> Option A

4. Quick Check:

   Network inspect = container connections + IPs [OK]

Hint: Inspect bridge network to see container IPs and connections [OK]

Common Mistakes:

• Confusing network inspect with container stats
• Expecting logs or firewall info from network inspect
• Misreading IP info as CPU or memory data

4. A container cannot reach the internet. You try docker exec app ping 8.8.8.8 but get 'ping: command not found'. What is the best next step?

medium

A. Run docker network disconnect bridge app to reset network.

B. Restart the Docker daemon with systemctl restart docker immediately.

C. Remove and recreate the container without any changes.

D. Install ping inside the container or use docker exec app apt-get update && apt-get install iputils-ping.

Solution

1. Step 1: Understand the error 'ping: command not found'

   This means the ping tool is missing inside the container's OS.

2. Step 2: Fix by installing ping inside the container

   Use package manager commands inside the container to install ping, e.g., apt-get install iputils-ping.

3. Final Answer:

   Install ping inside the container or use docker exec app apt-get update && apt-get install iputils-ping. -> Option D

4. Quick Check:

   Missing ping tool = install it inside container [OK]

Hint: If ping missing, install it inside container first [OK]

Common Mistakes:

• Restarting Docker daemon without checking container tools
• Removing container without diagnosing issue
• Disconnecting network without confirming problem source

5. You have two containers, frontend and backend, on a user-defined Docker network mynetwork. The frontend cannot connect to backend by container name. What is the best way to fix this?

hard

A. Use the default bridge network instead of a user-defined network for better name resolution.

B. Ensure both containers are connected to the same user-defined network mynetwork and use container names for communication.

C. Add --link backend option when starting the frontend container to enable name resolution.

D. Restart Docker daemon to refresh network settings.

Solution

1. Step 1: Understand Docker network name resolution

   Containers on the same user-defined network can resolve each other by container name automatically.

2. Step 2: Verify both containers are on the same network

   If frontend cannot reach backend by name, likely they are not on the same network. Connect both to mynetwork.

3. Step 3: Avoid deprecated or less flexible methods

   Using --link is deprecated and default bridge network does not support automatic name resolution.

4. Final Answer:

   Ensure both containers are connected to the same user-defined network mynetwork and use container names for communication. -> Option B

5. Quick Check:

   Same user network = container name resolution works [OK]

Hint: Connect containers to same user network for name resolution [OK]

Common Mistakes:

• Using default bridge network expecting name resolution
• Relying on deprecated --link option
• Restarting Docker daemon without checking network setup