Network inspection and debugging in Docker - Commands & Configuration

Introduction

Sometimes containers cannot talk to each other or to the outside world. Network inspection and debugging help find and fix these connection problems by checking how Docker networks and containers communicate.

When a container cannot reach another container on the same Docker network.

When your app inside a container cannot access the internet or external services.

When you want to see which networks exist and which containers are connected to them.

When you suspect a firewall or network rule is blocking container communication.

When you want to check the IP addresses and ports assigned to containers.

Commands

This command lists all Docker networks on your system so you can see available networks to inspect or debug.

Terminal

docker network ls

Expected Output

NETWORK ID     NAME      DRIVER    SCOPE

b1a2c3d4e5f6   bridge    bridge    local

c7d8e9f0a1b2   host      host      local

d3e4f5a6b7c8   none      null      local

This command shows detailed information about the 'bridge' network, including connected containers and their IP addresses.

Terminal

docker network inspect bridge

Expected Output

[

  {

    "Name": "bridge",

    "Id": "b1a2c3d4e5f6",

    "Created": "2024-06-01T12:00:00.000000000Z",

    "Scope": "local",

    "Driver": "bridge",

    "Containers": {

      "123abc456def": {

        "Name": "my-app",

        "EndpointID": "endpoint123",

        "MacAddress": "02:42:ac:11:00:02",

        "IPv4Address": "172.17.0.2/16",

        "IPv6Address": ""

      }

    },

    "Options": {},

    "Labels": {}

  }

]

This command runs a ping from inside the 'my-app' container to the Docker bridge gateway IP to check network connectivity.

Terminal

docker exec my-app ping -c 3 172.17.0.1

Expected Output

PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.

64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.123 ms

64 bytes from 172.17.0.1: icmp_seq=2 ttl=64 time=0.110 ms

64 bytes from 172.17.0.1: icmp_seq=3 ttl=64 time=0.115 ms



--- 172.17.0.1 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 2002ms

rtt min/avg/max/mdev = 0.110/0.116/0.123/0.006 ms

→

-c 3 - Send only 3 ping packets and then stop

This command shows the logs of the 'my-app' container to check for any network-related errors or messages.

Terminal

docker logs my-app

Expected Output

Starting application...

Connecting to database at 172.17.0.3:5432

Connection successful

Listening on port 8080

Key Concept

If you remember nothing else from this pattern, remember: use 'docker network inspect' to see how containers connect and 'docker exec' with ping to test inside-container connectivity.

Common Mistakes

Trying to ping container names instead of IP addresses inside containers without DNS setup.

Containers may not resolve names unless a user-defined network with DNS is used, causing ping to fail.

Use container IP addresses from 'docker network inspect' or create a user-defined network for automatic DNS.

Ignoring the network a container is connected to and assuming default bridge network behavior.

Containers on different networks cannot communicate unless networks are connected or bridged.

Check container networks with 'docker network inspect' and connect containers to the same network if needed.

Not checking container logs for network errors before debugging network settings.

Logs often show clear error messages that can save time troubleshooting network issues.

Always check 'docker logs' for the container before deep network inspection.

Summary

Use 'docker network ls' to list all Docker networks on your system.

Use 'docker network inspect <network>' to see detailed info about containers and IPs on that network.

Use 'docker exec <container> ping -c 3 <ip>' to test connectivity from inside a container.

Use 'docker logs <container>' to check for network-related errors or messages.