Network inspection and debugging in Docker - Commands & Configuration

Introduction

Sometimes containers cannot talk to each other or to the outside world. Network inspection and debugging help find and fix these connection problems by checking how Docker networks and containers communicate.

When a container cannot reach another container on the same Docker network.

When your app inside a container cannot access the internet or external services.

When you want to see which networks exist and which containers are connected to them.

When you suspect a firewall or network rule is blocking container communication.

When you want to check the IP addresses and ports assigned to containers.

Commands

This command lists all Docker networks on your system so you can see available networks to inspect or debug.

Terminal

docker network ls

Expected Output

NETWORK ID     NAME      DRIVER    SCOPE

b1a2c3d4e5f6   bridge    bridge    local

c7d8e9f0a1b2   host      host      local

d3e4f5a6b7c8   none      null      local

This command shows detailed information about the 'bridge' network, including connected containers and their IP addresses.

Terminal

docker network inspect bridge

Expected Output

[

  {

    "Name": "bridge",

    "Id": "b1a2c3d4e5f6",

    "Created": "2024-06-01T12:00:00.000000000Z",

    "Scope": "local",

    "Driver": "bridge",

    "Containers": {

      "123abc456def": {

        "Name": "my-app",

        "EndpointID": "endpoint123",

        "MacAddress": "02:42:ac:11:00:02",

        "IPv4Address": "172.17.0.2/16",

        "IPv6Address": ""

      }

    },

    "Options": {},

    "Labels": {}

  }

]

This command runs a ping from inside the 'my-app' container to the Docker bridge gateway IP to check network connectivity.

Terminal

docker exec my-app ping -c 3 172.17.0.1

Expected Output

PING 172.17.0.1 (172.17.0.1) 56(84) bytes of data.

64 bytes from 172.17.0.1: icmp_seq=1 ttl=64 time=0.123 ms

64 bytes from 172.17.0.1: icmp_seq=2 ttl=64 time=0.110 ms

64 bytes from 172.17.0.1: icmp_seq=3 ttl=64 time=0.115 ms



--- 172.17.0.1 ping statistics ---

3 packets transmitted, 3 received, 0% packet loss, time 2002ms

rtt min/avg/max/mdev = 0.110/0.116/0.123/0.006 ms

→

-c 3 - Send only 3 ping packets and then stop

This command shows the logs of the 'my-app' container to check for any network-related errors or messages.

Terminal

docker logs my-app

Expected Output

Starting application...

Connecting to database at 172.17.0.3:5432

Connection successful

Listening on port 8080

Key Concept

If you remember nothing else from this pattern, remember: use 'docker network inspect' to see how containers connect and 'docker exec' with ping to test inside-container connectivity.

Common Mistakes

Trying to ping container names instead of IP addresses inside containers without DNS setup.

Containers may not resolve names unless a user-defined network with DNS is used, causing ping to fail.

Use container IP addresses from 'docker network inspect' or create a user-defined network for automatic DNS.

Ignoring the network a container is connected to and assuming default bridge network behavior.

Containers on different networks cannot communicate unless networks are connected or bridged.

Check container networks with 'docker network inspect' and connect containers to the same network if needed.

Not checking container logs for network errors before debugging network settings.

Logs often show clear error messages that can save time troubleshooting network issues.

Always check 'docker logs' for the container before deep network inspection.

Summary

Use 'docker network ls' to list all Docker networks on your system.

Use 'docker network inspect <network>' to see detailed info about containers and IPs on that network.

Use 'docker exec <container> ping -c 3 <ip>' to test connectivity from inside a container.

Use 'docker logs <container>' to check for network-related errors or messages.

Practice

1. What does the Docker command docker network ls do?

easy

A. Creates a new Docker network

B. Shows running containers

C. Deletes a Docker network

D. Lists all Docker networks on the host

Solution

1. Step 1: Understand the command purpose

   The command docker network ls is used to list networks, not containers or create/delete networks.

2. Step 2: Match command to action

   Since it lists networks, it shows all Docker networks on the host machine.

3. Final Answer:

   Lists all Docker networks on the host -> Option D

4. Quick Check:

   docker network ls = list networks [OK]

Hint: Remember: 'ls' means list, so it lists networks [OK]

Common Mistakes:

• Confusing network listing with container listing
• Thinking it creates or deletes networks
• Mixing up 'docker network ls' with 'docker ps'

2. Which of the following is the correct syntax to inspect details of a Docker network named my_network?

easy

A. docker network show my_network

B. docker inspect network my_network

C. docker network inspect my_network

D. docker network details my_network

Solution

1. Step 1: Recall Docker network inspection syntax

   The correct command to inspect a network is docker network inspect <network_name>.

2. Step 2: Verify options

   Only docker network inspect my_network matches the correct syntax exactly.

3. Final Answer:

   docker network inspect my_network -> Option C

4. Quick Check:

   docker network inspect = inspect network [OK]

Hint: Use 'docker network inspect' to see network details [OK]

Common Mistakes:

• Swapping order of 'inspect' and 'network'
• Using non-existent commands like 'show' or 'details'
• Confusing with container inspect syntax

3. You run docker exec container1 ping -c 2 container2 to test connectivity. What output indicates successful communication?

medium

A. ping: unknown host container2

B. 2 packets transmitted, 2 received, 0% packet loss

C. 0 packets transmitted, 0 received, 100% packet loss

D. Error: container2 not found

Solution

1. Step 1: Understand ping output

   Successful ping shows packets transmitted and received with 0% packet loss.

2. Step 2: Match output to success

   2 packets transmitted, 2 received, 0% packet loss shows 2 packets sent and received with no loss, indicating success.

3. Final Answer:

   2 packets transmitted, 2 received, 0% packet loss -> Option B

4. Quick Check:

   Ping success = packets received with 0% loss [OK]

Hint: Look for 0% packet loss to confirm connectivity [OK]

Common Mistakes:

• Confusing error messages with success
• Ignoring packet loss percentage
• Assuming any ping output means success

4. You try docker network inspect mynet but get an error: Error: No such network: mynet. What is the most likely cause?

medium

A. The network 'mynet' does not exist on the host

B. You need to run the command inside a container

C. Docker daemon is not running

D. You must use 'docker inspect network mynet' instead

Solution

1. Step 1: Analyze error message

   The error says 'No such network', meaning Docker cannot find a network named 'mynet'.

2. Step 2: Identify cause

   This usually means the network was not created or was removed.

3. Final Answer:

   The network 'mynet' does not exist on the host -> Option A

4. Quick Check:

   Error 'No such network' = network missing [OK]

Hint: Check network list before inspecting to avoid missing network errors [OK]

Common Mistakes:

• Thinking command must run inside container
• Assuming Docker daemon is stopped without checking
• Using wrong command syntax

5. You have two containers, webapp and db, connected to a user-defined network appnet. You want to debug why webapp cannot reach db. Which sequence of commands helps you inspect and test the network connectivity?

hard

A. docker network inspect appnet; docker exec webapp ping -c 3 db

B. docker ps; docker logs webapp; docker network ls

C. docker network create appnet; docker exec db ping -c 3 webapp

D. docker exec webapp ifconfig; docker network rm appnet

Solution

1. Step 1: Inspect the network configuration

   Use docker network inspect appnet to check if both containers are connected properly.

2. Step 2: Test connectivity from webapp to db

   Run docker exec webapp ping -c 3 db to verify if webapp can reach db by name.

3. Final Answer:

   docker network inspect appnet; docker exec webapp ping -c 3 db -> Option A

4. Quick Check:

   Inspect network then ping from source to target [OK]

Hint: Inspect network first, then ping from source container [OK]

Common Mistakes:

• Trying to ping from db to webapp instead of webapp to db
• Creating network again instead of inspecting existing
• Removing network before debugging