Docker Network Cheatsheet — Bridge, Host, Overlay & Port Mapping
Docker networking connects containers to each other and to the outside world. This guide covers all network drivers, how to expose ports, link containers, and manage custom networks.
Quick Reference
| Scenario | Command |
| List networks | docker network ls |
| Inspect a network | docker network inspect bridge |
| Create a custom bridge network | docker network create my-net |
| Connect container to network | docker network connect my-net my-container |
| Disconnect container from network | docker network disconnect my-net my-container |
| Remove a network | docker network rm my-net |
| Run container with port mapping | docker run -p 8080:80 nginx |
| Run container on specific network | docker run --network my-net nginx |
| Prune unused networks | docker network prune |
Network Drivers
| Driver | Isolation | Scope | Use Case |
| bridge | ✅ Per-network | Local host | Default. Container-to-container on same host |
| host | ❌ None | Local host | Max performance, no NAT (e.g., monitoring tools) |
| overlay | ✅ Per-network | Multi-host | Swarm services, multi-host communication |
| none | Full isolation | Local host | No network at all (loopback only) |
| macvlan | Per container | Local host | Assign MAC addresses, appear as physical devices |
Core Commands
### Managing Networks
``bash
# List all networks
docker network ls
# NETWORK ID NAME DRIVER SCOPE
# abc12345 bridge bridge local
# def67890 host host local
# Create a custom bridge network docker network create --driver bridge my-app-network
# Create with custom subnet docker network create --subnet 172.20.0.0/16 my-custom-net
# Inspect network details docker network inspect my-app-network
# Remove a network docker network rm my-app-network
# Clean up unused networks
docker network prune
`
### Connecting Containers
`bash
# Run container on a specific network
docker run -d --name api --network my-app-network my-api:latest
# Connect an existing container docker network connect my-app-network my-database
# Disconnect a container docker network disconnect my-app-network old-container
# Verify connectivity
docker exec api ping my-database # Container name resolves automatically on user-defined networks
`
### Port Mapping
`bash
# Map host port 8080 to container port 80
docker run -p 8080:80 nginx
# Map multiple ports docker run -p 8080:80 -p 443:443 nginx
# Bind to specific host IP docker run -p 127.0.0.1:8080:80 nginx
# Random host port (let Docker choose) docker run -P nginx
# UDP port mapping
docker run -p 53:53/udp dns-server
`
### Inspecting Networks
`bash
# Inspect default bridge
docker network inspect bridge
# Inspect custom network (shows connected containers) docker network inspect my-app-network
# Show detailed container network config docker inspect --format '{{json .NetworkSettings}}' my-container | jq
# List containers on a network
docker network inspect -f '{{range .Containers}}{{.Name}} {{end}}' my-net
`
Port Mapping vs Network Connect
Both approaches expose containers to other services, but they serve different purposes.
| Aspect | Port Mapping (-p) | Network Connect (--network) |
| Access from outside host | ✅ Yes (via host IP) | ❌ No (internal only) |
| Container-to-container DNS | ❌ Manual IP needed | ✅ Automatic name resolution |
| Port conflicts | ❌ Conflicts on same host port | ✅ No port conflicts |
| Security | Exposed to host network | Isolated on virtual network |
| Multiple networks | ❌ Single host port binding | ✅ Container on many networks |
| Load balancing | ❌ Manual | ✅ DNS round-robin (user-defined) |
- Port mapping: Expose a container to the outside world — web apps, APIs, databases accessed from outside the host. - Network connect: Enable inter-container communication — microservices talking to each other, backend containers that don't need external access.
Example — combining both:
`bash
# Create a shared network
docker network create backend-net
# Database accessible only to other containers docker run -d --name db --network backend-net postgres:13
# API exposed to the world, also talks to DB docker run -d --name api --network backend-net -p 8080:80 my-api # api can reach db via hostname "db"; api is also available on host:8080 ``
Network(26)
| Command | Level | ||
|---|---|---|---|
docker network createCreate a new network | Basic | docker network create my-network | |
docker network lsList all networks | Basic | docker network ls | |
docker network inspectInspect network details | Basic | docker network inspect my-network | |
docker network connectConnect a container to a network | Intermediate | docker network connect my-network my-container | |
docker network disconnectDisconnect a container from a network | Intermediate | docker network disconnect my-network my-container | |
docker network rmRemove one or more networks | Basic | docker network rm my-network | |
docker network pruneRemove all unused networks | Expert | docker network prune | |
docker network --helpDisplay docker network help information | Basic | docker network --help | |
docker network ls -qDisplay only network IDs | Basic | docker network ls -q | |
docker network ls --filterList networks filtered by criteria | Intermediate | docker network ls --filter driver=bridge | |
docker network create --driverCreate a network with a specific driver | Intermediate | docker network create --driver bridge my-bridge | |
docker network create --driver overlayCreate an overlay network driver (Swarm mode) | Expert | docker network create --driver overlay my-overlay | |
docker network create --subnetCreate a network with a custom subnet | Intermediate | docker network create --subnet 172.20.0.0/16 my-network | |
docker network create --gateway --ip-rangeCreate a network with gateway and IP range | Expert | docker network create --subnet 172.20.0.0/16 --gateway 172.20.0.1 --ip-range 172.20.10.0/24 my-network | |
docker network create --internalCreate an internal network (no external access) | Intermediate | docker network create --internal my-internal | |
docker network create --attachableCreate an attachable overlay network | Expert | docker network create --driver overlay --attachable my-attachable | |
docker network create --ipv6Create a network with IPv6 enabled | Expert | docker network create --ipv6 --subnet 2001:db8::/64 my-ipv6-net | |
docker network create --labelCreate a network with metadata labels | Intermediate | docker network create --label env=prod --label team=backend my-network | |
docker network create -oCreate a network with driver-specific options | Expert | docker network create -o com.docker.network.bridge.enable_icc=false my-secure-bridge | |
docker network connect --ipConnect a container with a specific IP address | Intermediate | docker network connect --ip 172.20.0.10 my-network my-container | |
docker network connect --aliasConnect a container with a network alias | Intermediate | docker network connect --alias db my-network my-container | |
docker network inspect --verboseInspect network configuration with verbose details | Intermediate | docker network inspect --verbose my-network | |
docker network inspect --formatCustom format network inspection output | Expert | docker network inspect --format '{{.Name}} {{.Driver}}' my-network | |
docker network disconnect --forceForce disconnect a container from a network | Intermediate | docker network disconnect --force my-network my-container | |
docker network prune -fForce remove all unused networks without confirmation | Basic | docker network prune -f | |
docker network prune --filterPrune unused networks with filter | Expert | docker network prune --filter "until=24h" |