Network isolation between services in Docker - Mini Project: Build & Apply

Network isolation between services

📖 Scenario: You are setting up two simple services using Docker containers. You want to make sure these services cannot talk to each other by isolating their networks.This is like having two separate rooms in a house where people cannot hear or see each other.

🎯 Goal: Create two Docker containers each connected to its own isolated network. Verify that the containers cannot communicate with each other.

📋 What You'll Learn

Create two Docker networks named network1 and network2

Run two containers named service1 and service2 each connected to one of the networks

Try to ping service2 from service1 and confirm it fails

Print the ping command output to show network isolation

💡 Why This Matters

🌍 Real World

Network isolation is used to keep different services or applications separated for security and stability, like having separate rooms for different activities.

💼 Career

Understanding Docker network isolation is important for DevOps roles to manage containerized applications securely and avoid unwanted communication between services.

1

Create two Docker networks

Create two Docker networks named network1 and network2 using the docker network create command.

Docker

# Create network1
# Create network2

Hint

Use docker network create followed by the network name.

2

Run two containers on separate networks

Run two containers named service1 and service2 using the alpine image. Connect service1 to network1 and service2 to network2. Use the docker run command with --network and --name options.

Docker

docker network create network1
docker network create network2
# Run service1 on network1
# Run service2 on network2

Hint

Use docker run -dit --name <name> --network <network> alpine sh to start containers.

3

Try to ping service2 from service1

Use docker exec to run the command ping -c 1 service2 inside the service1 container. This tests if service1 can reach service2.

Docker

docker network create network1
docker network create network2
docker run -dit --name service1 --network network1 alpine sh
docker run -dit --name service2 --network network2 alpine sh
# Run ping command from service1 to service2

Hint

Use docker exec service1 ping -c 1 service2 to test connectivity.

4

Show the ping output to confirm isolation

Print the output of the ping command run inside service1 to show that service2 is unreachable due to network isolation.

Docker

docker network create network1
docker network create network2
docker run -dit --name service1 --network network1 alpine sh
docker run -dit --name service2 --network network2 alpine sh
docker exec service1 ping -c 1 service2
# The ping output will show failure

Hint

The ping command should fail because the networks are isolated.

Practice

1. What is the main purpose of network isolation between Docker services?

easy

A. To keep services separate and control their communication

B. To speed up container startup time

C. To reduce the size of Docker images

D. To automatically update containers

Solution

1. Step 1: Understand network isolation concept

   Network isolation means keeping services separate so they don't communicate unless allowed.

2. Step 2: Identify the main goal

   The main goal is to control communication and improve security between services.

3. Final Answer:

   To keep services separate and control their communication -> Option A

4. Quick Check:

   Network isolation = separate and control communication [OK]

Hint: Network isolation means controlling service communication [OK]

Common Mistakes:

• Confusing network isolation with image size optimization
• Thinking it speeds up container startup
• Assuming it updates containers automatically

2. Which Docker command creates a custom network for isolating services?

easy

A. docker image build my-network

B. docker container run my-network

C. docker network create my-network

D. docker service start my-network

Solution

1. Step 1: Identify command to create network

   The command to create a Docker network is docker network create followed by the network name.

2. Step 2: Match correct syntax

   docker network create my-network uses the correct syntax: docker network create my-network.

3. Final Answer:

   docker network create my-network -> Option C

4. Quick Check:

   Creating network = docker network create [OK]

Hint: Use 'docker network create' to make custom networks [OK]

Common Mistakes:

• Using 'docker container run' to create networks
• Confusing image build with network creation
• Trying to start a service to create a network

3. Given two containers attached to different custom networks, what happens if one tries to ping the other by container name?

medium

A. Ping succeeds because Docker allows cross-network communication by default

B. Ping fails because containers on different networks cannot resolve each other's names

C. Ping succeeds only if both containers share the same image

D. Ping fails unless both containers are on the default bridge network

Solution

1. Step 1: Understand Docker network isolation

   Containers on different custom networks cannot communicate or resolve each other's names by default.

2. Step 2: Analyze ping behavior

   Since they are on separate networks, ping by container name will fail due to no DNS resolution across networks.

3. Final Answer:

   Ping fails because containers on different networks cannot resolve each other's names -> Option B

4. Quick Check:

   Different networks = no name resolution [OK]

Hint: Containers on different networks can't ping by name [OK]

Common Mistakes:

• Assuming default bridge allows all communication
• Thinking image similarity affects network reachability
• Believing Docker allows cross-network DNS by default

4. You created two services on the same custom network but they cannot communicate. What is the most likely mistake?

medium

A. The services have the same container name

B. The network was created with the wrong driver

C. The services are not attached to the same network

D. The containers are running on different Docker hosts

Solution

1. Step 1: Check network attachment

   If services are on the same network, they should communicate unless other factors block it.

2. Step 2: Consider Docker host location

   If containers run on different Docker hosts without overlay network, they cannot communicate even on the same network name.

3. Final Answer:

   The containers are running on different Docker hosts -> Option D

4. Quick Check:

   Different hosts without overlay = no communication [OK]

Hint: Check if containers run on same host or overlay network [OK]

Common Mistakes:

• Assuming same network name means same network across hosts
• Ignoring network driver type
• Confusing container names with network connectivity

5. You want two services to communicate but keep them isolated from all other containers. Which is the best approach?

hard

A. Create a custom network and attach only these two services to it

B. Use the default bridge network for both services

C. Attach both services to multiple networks including default

D. Run both services on the host network

Solution

1. Step 1: Understand isolation needs

   To isolate two services from others, they must be on a private network only they share.

2. Step 2: Choose network setup

   Creating a custom network and attaching only these two services ensures isolation and communication.

3. Step 3: Evaluate other options

   Default bridge includes all containers, multiple networks reduce isolation, host network removes isolation.

4. Final Answer:

   Create a custom network and attach only these two services to it -> Option A

5. Quick Check:

   Custom network with only two services = isolation + communication [OK]

Hint: Use custom network with only needed services attached [OK]

Common Mistakes:

• Using default network which includes all containers
• Attaching services to multiple networks losing isolation
• Using host network which disables isolation