Network isolation between services in Docker - Step-by-Step Execution

Process Flow - Network isolation between services

Create Docker Networks

↓

Assign Services to Networks

↓

Services Communicate Only Within Same Network

↓

No Cross-Network Communication Without Explicit Connection

↓

Isolated Service Groups Achieved

Docker networks are created and services are assigned to them. Services can only talk to others on the same network, isolating communication.

Execution Sample

Docker

docker network create frontend_net

docker network create backend_net

docker run -d --name frontend --network frontend_net nginx

docker run -d --name backend --network backend_net redis

Creates two separate networks and runs frontend and backend services isolated on their own networks.

Process Table

Step	Command	Action	Result
1	docker network create frontend_net	Create network named frontend_net	Network 'frontend_net' created
2	docker network create backend_net	Create network named backend_net	Network 'backend_net' created
3	docker run -d --name frontend --network frontend_net nginx	Start nginx container on frontend_net	Container 'frontend' running on 'frontend_net'
4	docker run -d --name backend --network backend_net redis	Start redis container on backend_net	Container 'backend' running on 'backend_net'
5	Test connectivity frontend -> backend	Ping backend from frontend container	Fails: No route to host
6	Test connectivity backend -> frontend	Ping frontend from backend container	Fails: No route to host

💡 Services are isolated because they are on different Docker networks with no shared connection

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
frontend_net	none	created	created	created	created	created
backend_net	none	none	created	created	created	created
frontend container network	none	none	none	frontend_net	frontend_net	frontend_net
backend container network	none	none	none	none	backend_net	backend_net

Key Moments - 2 Insights

Why can't the frontend container communicate with the backend container?

Because they are attached to different Docker networks (frontend_net and backend_net), which isolates their network traffic as shown in execution_table rows 5 and 6.

Can containers on different networks communicate by default?

No, Docker networks isolate containers by default. Communication requires explicit network connection or shared network, as shown by failed pings in execution_table.

Visual Quiz - 3 Questions

Look at the execution table, what network is the frontend container connected to after step 3?

A backend_net

B bridge

C frontend_net

D none

💡 Hint

Check the 'Result' column in row 3 of the execution_table

At which step does the backend container start running on its network?

A Step 4

B Step 3

C Step 2

D Step 5

💡 Hint

Look at the 'Action' and 'Result' columns for backend container start in execution_table

If both containers were on the same network, what would change in the execution table?

A Networks would not be created

B Ping tests would succeed

C Containers would not start

D No change

💡 Hint

Refer to rows 5 and 6 where ping fails due to network isolation

Concept Snapshot

Docker network isolation:
- Create separate networks with 'docker network create'
- Run containers with '--network' to assign network
- Containers on different networks cannot communicate by default
- Use shared networks or connect containers to multiple networks for communication
- Ensures service isolation and security

Full Transcript

This visual execution shows how Docker network isolation works by creating two networks, frontend_net and backend_net. Containers are started on these networks separately. The frontend container runs on frontend_net and the backend container runs on backend_net. Because they are on different networks, attempts to ping one from the other fail, demonstrating isolation. Variables track network creation and container network assignment. Key moments clarify why containers cannot communicate across networks without explicit connection. The quiz tests understanding of network assignment and communication limits. This teaches how Docker networks isolate services to keep them separate and secure.

Practice

1. What is the main purpose of network isolation between Docker services?

easy

A. To keep services separate and control their communication

B. To speed up container startup time

C. To reduce the size of Docker images

D. To automatically update containers

Solution

1. Step 1: Understand network isolation concept

   Network isolation means keeping services separate so they don't communicate unless allowed.

2. Step 2: Identify the main goal

   The main goal is to control communication and improve security between services.

3. Final Answer:

   To keep services separate and control their communication -> Option A

4. Quick Check:

   Network isolation = separate and control communication [OK]

Hint: Network isolation means controlling service communication [OK]

Common Mistakes:

• Confusing network isolation with image size optimization
• Thinking it speeds up container startup
• Assuming it updates containers automatically

2. Which Docker command creates a custom network for isolating services?

easy

A. docker image build my-network

B. docker container run my-network

C. docker network create my-network

D. docker service start my-network

Solution

1. Step 1: Identify command to create network

   The command to create a Docker network is docker network create followed by the network name.

2. Step 2: Match correct syntax

   docker network create my-network uses the correct syntax: docker network create my-network.

3. Final Answer:

   docker network create my-network -> Option C

4. Quick Check:

   Creating network = docker network create [OK]

Hint: Use 'docker network create' to make custom networks [OK]

Common Mistakes:

• Using 'docker container run' to create networks
• Confusing image build with network creation
• Trying to start a service to create a network

3. Given two containers attached to different custom networks, what happens if one tries to ping the other by container name?

medium

A. Ping succeeds because Docker allows cross-network communication by default

B. Ping fails because containers on different networks cannot resolve each other's names

C. Ping succeeds only if both containers share the same image

D. Ping fails unless both containers are on the default bridge network

Solution

1. Step 1: Understand Docker network isolation

   Containers on different custom networks cannot communicate or resolve each other's names by default.

2. Step 2: Analyze ping behavior

   Since they are on separate networks, ping by container name will fail due to no DNS resolution across networks.

3. Final Answer:

   Ping fails because containers on different networks cannot resolve each other's names -> Option B

4. Quick Check:

   Different networks = no name resolution [OK]

Hint: Containers on different networks can't ping by name [OK]

Common Mistakes:

• Assuming default bridge allows all communication
• Thinking image similarity affects network reachability
• Believing Docker allows cross-network DNS by default

4. You created two services on the same custom network but they cannot communicate. What is the most likely mistake?

medium

A. The services have the same container name

B. The network was created with the wrong driver

C. The services are not attached to the same network

D. The containers are running on different Docker hosts

Solution

1. Step 1: Check network attachment

   If services are on the same network, they should communicate unless other factors block it.

2. Step 2: Consider Docker host location

   If containers run on different Docker hosts without overlay network, they cannot communicate even on the same network name.

3. Final Answer:

   The containers are running on different Docker hosts -> Option D

4. Quick Check:

   Different hosts without overlay = no communication [OK]

Hint: Check if containers run on same host or overlay network [OK]

Common Mistakes:

• Assuming same network name means same network across hosts
• Ignoring network driver type
• Confusing container names with network connectivity

5. You want two services to communicate but keep them isolated from all other containers. Which is the best approach?

hard

A. Create a custom network and attach only these two services to it

B. Use the default bridge network for both services

C. Attach both services to multiple networks including default

D. Run both services on the host network

Solution

1. Step 1: Understand isolation needs

   To isolate two services from others, they must be on a private network only they share.

2. Step 2: Choose network setup

   Creating a custom network and attaching only these two services ensures isolation and communication.

3. Step 3: Evaluate other options

   Default bridge includes all containers, multiple networks reduce isolation, host network removes isolation.

4. Final Answer:

   Create a custom network and attach only these two services to it -> Option A

5. Quick Check:

   Custom network with only two services = isolation + communication [OK]

Hint: Use custom network with only needed services attached [OK]

Common Mistakes:

• Using default network which includes all containers
• Attaching services to multiple networks losing isolation
• Using host network which disables isolation