Network isolation between services in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Docker network isolation

Which Docker network driver provides complete isolation between containers, preventing them from communicating unless explicitly connected?

A host

B none

C bridge

D overlay

💡 Hint

Think about a network driver that disables all networking for containers.

The none network driver disables all networking for the container, isolating it completely. Other drivers like bridge allow communication within the network, host shares the host network, and overlay is for multi-host networking.

💻 Command Output

intermediate

Inspecting Docker networks

What is the output of the command docker network ls after creating a user-defined bridge network named isolated_net?

Docker

docker network create isolated_net
docker network ls

A

NETWORK ID   NAME           DRIVER    SCOPE
xxxxxx       bridge         bridge    local
xxxxxx       host           host      local
xxxxxx       none           null      local
isolated_net  isolated_net   bridge    local

B

NETWORK ID   NAME           DRIVER    SCOPE
xxxxxx       bridge         host      local
xxxxxx       host           bridge    local
xxxxxx       none           null      local
xxxxxx       isolated_net   overlay   local

C

NETWORK ID   NAME           DRIVER    SCOPE
xxxxxx       bridge         bridge    local
xxxxxx       host           host      local
xxxxxx       none           none      local
xxxxxx       isolated_net   bridge    local

D

NETWORK ID   NAME           DRIVER    SCOPE
xxxxxx       bridge         bridge    local
xxxxxx       host           host      local
xxxxxx       none           null      local
xxxxxx       isolated_net   bridge    local

💡 Hint

Look for the user-defined network with the correct driver and scope.

When you create a user-defined bridge network, it appears in the list with the bridge driver and local scope. The default networks bridge, host, and none also appear.

❓ Configuration

advanced

Isolating two services using Docker Compose networks

You want to run two services, web and db, in Docker Compose. The web service should not communicate with db. Which network configuration achieves this isolation?

Docker

version: '3.8'
services:
  web:
    image: nginx
    networks:
      - webnet
  db:
    image: mysql
    networks:
      - dbnet
networks:
  webnet:
  dbnet:

A Each service is attached to a separate network: 'webnet' for web and 'dbnet' for db, isolating them.

B No networks defined, so Docker isolates services by default.

C Both services are attached to both networks 'webnet' and 'dbnet' to isolate them.

D Both services share the same network 'webnet' to isolate them.

💡 Hint

Think about how Docker Compose networks control communication between services.

Assigning each service to a separate network isolates them because containers can only communicate if they share a network. Sharing the same network allows communication.

❓ Troubleshoot

advanced

Troubleshooting container communication failure

You have two containers connected to the same user-defined bridge network but they cannot ping each other. What is the most likely cause?

A The containers are running on the host network driver.

B The containers are connected to the default bridge network instead.

C The containers are on different Docker hosts.

D The containers have different IP addresses.

💡 Hint

Consider network scope and physical host location.

User-defined bridge networks are local to a single Docker host. Containers on different hosts cannot communicate over this network unless using overlay networks or other multi-host solutions.

✅ Best Practice

expert

Best practice for secure network isolation in multi-service Docker apps

In a multi-service Docker application, what is the best practice to ensure secure network isolation between services that should not communicate?

A Create separate user-defined bridge networks for each group of services that need to communicate, and connect services only to their required networks.

B Use the host network driver for all services to improve performance and isolate them.

C Use the default bridge network and rely on container firewall rules.

D Connect all services to a single overlay network and use service labels to control communication.

💡 Hint

Think about how Docker networks control communication and isolation.

Creating separate user-defined bridge networks and connecting services only to the networks they need limits communication to only those services. The default bridge network is shared and less secure. The host network driver shares the host network and does not isolate. Overlay networks are for multi-host but require additional configuration.