Network isolation between services in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Docker network isolation

Which Docker network driver provides complete isolation between containers, preventing them from communicating unless explicitly connected?

A host

B none

C bridge

D overlay

💡 Hint

Think about a network driver that disables all networking for containers.

The none network driver disables all networking for the container, isolating it completely. Other drivers like bridge allow communication within the network, host shares the host network, and overlay is for multi-host networking.

💻 Command Output

intermediate

Inspecting Docker networks

What is the output of the command docker network ls after creating a user-defined bridge network named isolated_net?

Docker

docker network create isolated_net
docker network ls

A

NETWORK ID   NAME           DRIVER    SCOPE
xxxxxx       bridge         bridge    local
xxxxxx       host           host      local
xxxxxx       none           null      local
isolated_net  isolated_net   bridge    local

B

NETWORK ID   NAME           DRIVER    SCOPE
xxxxxx       bridge         host      local
xxxxxx       host           bridge    local
xxxxxx       none           null      local
xxxxxx       isolated_net   overlay   local

C

NETWORK ID   NAME           DRIVER    SCOPE
xxxxxx       bridge         bridge    local
xxxxxx       host           host      local
xxxxxx       none           none      local
xxxxxx       isolated_net   bridge    local

D

NETWORK ID   NAME           DRIVER    SCOPE
xxxxxx       bridge         bridge    local
xxxxxx       host           host      local
xxxxxx       none           null      local
xxxxxx       isolated_net   bridge    local

💡 Hint

Look for the user-defined network with the correct driver and scope.

When you create a user-defined bridge network, it appears in the list with the bridge driver and local scope. The default networks bridge, host, and none also appear.

❓ Configuration

advanced

Isolating two services using Docker Compose networks

You want to run two services, web and db, in Docker Compose. The web service should not communicate with db. Which network configuration achieves this isolation?

Docker

version: '3.8'
services:
  web:
    image: nginx
    networks:
      - webnet
  db:
    image: mysql
    networks:
      - dbnet
networks:
  webnet:
  dbnet:

A Each service is attached to a separate network: 'webnet' for web and 'dbnet' for db, isolating them.

B No networks defined, so Docker isolates services by default.

C Both services are attached to both networks 'webnet' and 'dbnet' to isolate them.

D Both services share the same network 'webnet' to isolate them.

💡 Hint

Think about how Docker Compose networks control communication between services.

Assigning each service to a separate network isolates them because containers can only communicate if they share a network. Sharing the same network allows communication.

❓ Troubleshoot

advanced

Troubleshooting container communication failure

You have two containers connected to the same user-defined bridge network but they cannot ping each other. What is the most likely cause?

A The containers are running on the host network driver.

B The containers are connected to the default bridge network instead.

C The containers are on different Docker hosts.

D The containers have different IP addresses.

💡 Hint

Consider network scope and physical host location.

User-defined bridge networks are local to a single Docker host. Containers on different hosts cannot communicate over this network unless using overlay networks or other multi-host solutions.

✅ Best Practice

expert

Best practice for secure network isolation in multi-service Docker apps

In a multi-service Docker application, what is the best practice to ensure secure network isolation between services that should not communicate?

A Create separate user-defined bridge networks for each group of services that need to communicate, and connect services only to their required networks.

B Use the host network driver for all services to improve performance and isolate them.

C Use the default bridge network and rely on container firewall rules.

D Connect all services to a single overlay network and use service labels to control communication.

💡 Hint

Think about how Docker networks control communication and isolation.

Creating separate user-defined bridge networks and connecting services only to the networks they need limits communication to only those services. The default bridge network is shared and less secure. The host network driver shares the host network and does not isolate. Overlay networks are for multi-host but require additional configuration.

Practice

1. What is the main purpose of network isolation between Docker services?

easy

A. To keep services separate and control their communication

B. To speed up container startup time

C. To reduce the size of Docker images

D. To automatically update containers

Solution

1. Step 1: Understand network isolation concept

   Network isolation means keeping services separate so they don't communicate unless allowed.

2. Step 2: Identify the main goal

   The main goal is to control communication and improve security between services.

3. Final Answer:

   To keep services separate and control their communication -> Option A

4. Quick Check:

   Network isolation = separate and control communication [OK]

Hint: Network isolation means controlling service communication [OK]

Common Mistakes:

• Confusing network isolation with image size optimization
• Thinking it speeds up container startup
• Assuming it updates containers automatically

2. Which Docker command creates a custom network for isolating services?

easy

A. docker image build my-network

B. docker container run my-network

C. docker network create my-network

D. docker service start my-network

Solution

1. Step 1: Identify command to create network

   The command to create a Docker network is docker network create followed by the network name.

2. Step 2: Match correct syntax

   docker network create my-network uses the correct syntax: docker network create my-network.

3. Final Answer:

   docker network create my-network -> Option C

4. Quick Check:

   Creating network = docker network create [OK]

Hint: Use 'docker network create' to make custom networks [OK]

Common Mistakes:

• Using 'docker container run' to create networks
• Confusing image build with network creation
• Trying to start a service to create a network

3. Given two containers attached to different custom networks, what happens if one tries to ping the other by container name?

medium

A. Ping succeeds because Docker allows cross-network communication by default

B. Ping fails because containers on different networks cannot resolve each other's names

C. Ping succeeds only if both containers share the same image

D. Ping fails unless both containers are on the default bridge network

Solution

1. Step 1: Understand Docker network isolation

   Containers on different custom networks cannot communicate or resolve each other's names by default.

2. Step 2: Analyze ping behavior

   Since they are on separate networks, ping by container name will fail due to no DNS resolution across networks.

3. Final Answer:

   Ping fails because containers on different networks cannot resolve each other's names -> Option B

4. Quick Check:

   Different networks = no name resolution [OK]

Hint: Containers on different networks can't ping by name [OK]

Common Mistakes:

• Assuming default bridge allows all communication
• Thinking image similarity affects network reachability
• Believing Docker allows cross-network DNS by default

4. You created two services on the same custom network but they cannot communicate. What is the most likely mistake?

medium

A. The services have the same container name

B. The network was created with the wrong driver

C. The services are not attached to the same network

D. The containers are running on different Docker hosts

Solution

1. Step 1: Check network attachment

   If services are on the same network, they should communicate unless other factors block it.

2. Step 2: Consider Docker host location

   If containers run on different Docker hosts without overlay network, they cannot communicate even on the same network name.

3. Final Answer:

   The containers are running on different Docker hosts -> Option D

4. Quick Check:

   Different hosts without overlay = no communication [OK]

Hint: Check if containers run on same host or overlay network [OK]

Common Mistakes:

• Assuming same network name means same network across hosts
• Ignoring network driver type
• Confusing container names with network connectivity

5. You want two services to communicate but keep them isolated from all other containers. Which is the best approach?

hard

A. Create a custom network and attach only these two services to it

B. Use the default bridge network for both services

C. Attach both services to multiple networks including default

D. Run both services on the host network

Solution

1. Step 1: Understand isolation needs

   To isolate two services from others, they must be on a private network only they share.

2. Step 2: Choose network setup

   Creating a custom network and attaching only these two services ensures isolation and communication.

3. Step 3: Evaluate other options

   Default bridge includes all containers, multiple networks reduce isolation, host network removes isolation.

4. Final Answer:

   Create a custom network and attach only these two services to it -> Option A

5. Quick Check:

   Custom network with only two services = isolation + communication [OK]

Hint: Use custom network with only needed services attached [OK]

Common Mistakes:

• Using default network which includes all containers
• Attaching services to multiple networks losing isolation
• Using host network which disables isolation