Docker Compose Networking

Master network configuration and service communication patterns in Docker Compose for building secure, scalable multi-container applications.

Default Bridge Network

Docker Compose automatically creates a default bridge network for all services in a compose file:

version: '3.8'

services: frontend: image: nginx:alpine ports: - "80:80" # Can reach backend using service name as hostname

backend: image: node:18-alpine command: node server.js # Accessible at hostname 'backend' from frontend

database: image: postgres:15-alpine environment: POSTGRES_PASSWORD: secret # Accessible at hostname 'database' from backend

In this setup:

• All services can communicate using service names as hostnames

• Frontend can reach backend at http://backend:3000

• Backend can reach database at postgres://database:5432

• Only frontend's port 80 is exposed to host

Custom Bridge Networks

Define custom networks for service isolation and segmentation:

version: '3.8'

services: frontend: image: nginx:alpine networks: - frontend-network ports: - "80:80"

api: image: node:18-alpine networks: - frontend-network - backend-network environment: DATABASE_URL: postgresql://db:5432/app

database: image: postgres:15-alpine networks: - backend-network environment: POSTGRES_PASSWORD: secret POSTGRES_DB: app volumes: - db-data:/var/lib/postgresql/data

cache: image: redis:7-alpine networks: - backend-network command: redis-server --appendonly yes volumes: - redis-data:/data

networks: frontend-network: driver: bridge backend-network: driver: bridge internal: true

volumes: db-data: redis-data:

Network isolation:

• Frontend can only reach API

• Frontend cannot reach database or cache directly

• API can reach all services

• Backend network is internal (no external access)

Network Aliases

Configure multiple hostnames for service discovery:

version: '3.8'

services: web: image: nginx:alpine networks: public: aliases: - website - www - web-server internal: aliases: - web-internal

api: image: node:18-alpine networks: public: aliases: - api-server - backend internal: aliases: - api-internal depends_on: - database

database: image: postgres:15-alpine networks: internal: aliases: - db - postgres - primary-db environment: POSTGRES_PASSWORD: secret

networks: public: driver: bridge internal: driver: bridge internal: true

Services can be reached by any of their aliases:

• http://website , http://www , http://web-server all reach web service

• postgresql://db:5432 , postgresql://postgres:5432 both reach database

Static IP Addresses

Assign fixed IP addresses for services requiring stable networking:

version: '3.8'

services: loadbalancer: image: nginx:alpine networks: app-network: ipv4_address: 172.28.1.10 ports: - "80:80" volumes: - ./nginx.conf:/etc/nginx/nginx.conf:ro

app-1: image: myapp:latest networks: app-network: ipv4_address: 172.28.1.11 environment: APP_ID: "1"

app-2: image: myapp:latest networks: app-network: ipv4_address: 172.28.1.12 environment: APP_ID: "2"

app-3: image: myapp:latest networks: app-network: ipv4_address: 172.28.1.13 environment: APP_ID: "3"

database: image: postgres:15-alpine networks: app-network: ipv4_address: 172.28.1.20 environment: POSTGRES_PASSWORD: secret volumes: - pgdata:/var/lib/postgresql/data

networks: app-network: driver: bridge ipam: driver: default config: - subnet: 172.28.0.0/16 gateway: 172.28.1.1

volumes: pgdata:

External Networks

Connect to existing Docker networks created outside Compose:

version: '3.8'

services: api: image: node:18-alpine networks: - app-network - shared-network environment: DATABASE_URL: postgresql://db:5432/app

database: image: postgres:15-alpine networks: - app-network environment: POSTGRES_PASSWORD: secret volumes: - pgdata:/var/lib/postgresql/data

networks: app-network: driver: bridge

shared-network: external: true name: company-shared-network

volumes: pgdata:

Create external network first:

docker network create company-shared-network docker compose up -d

Host Network Mode

Use host networking for maximum performance (Linux only):

version: '3.8'

services: high-performance-app: image: myapp:latest network_mode: "host" environment: BIND_ADDRESS: "0.0.0.0" PORT: "8080" # No port mapping needed - directly uses host's network stack

monitoring: image: prometheus:latest network_mode: "host" volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro - prometheus-data:/prometheus command: - '--config.file=/etc/prometheus/prometheus.yml' - '--storage.tsdb.path=/prometheus' - '--web.listen-address=0.0.0.0:9090'

volumes: prometheus-data:

Note: Host networking bypasses Docker network isolation and is typically used for monitoring tools or high-throughput applications.

Service Discovery and DNS

Configure DNS resolution and service discovery:

version: '3.8'

services: api: image: node:18-alpine networks: - app-network dns: - 8.8.8.8 - 8.8.4.4 dns_search: - company.local extra_hosts: - "legacy-api.company.local:192.168.1.100" - "auth-service.company.local:192.168.1.101" environment: DATABASE_HOST: database.company.local

database: image: postgres:15-alpine networks: app-network: aliases: - database.company.local - db.company.local hostname: primary-database domainname: company.local environment: POSTGRES_PASSWORD: secret volumes: - pgdata:/var/lib/postgresql/data

networks: app-network: driver: bridge driver_opts: com.docker.network.bridge.name: br-company-app

volumes: pgdata:

Link Containers (Legacy)

While links is deprecated, understanding it helps migrate legacy configurations:

version: '3.8'

services:

Modern approach - use networks instead

web: image: nginx:alpine networks: - app-network depends_on: - api

api: image: node:18-alpine networks: - app-network depends_on: - database environment: # Use service name as hostname DATABASE_URL: postgresql://database:5432/app

database: image: postgres:15-alpine networks: - app-network environment: POSTGRES_PASSWORD: secret

networks: app-network: driver: bridge

Multi-Network Architecture

Complex applications with multiple isolated networks:

version: '3.8'

services: nginx: image: nginx:alpine networks: - public ports: - "80:80" - "443:443" volumes: - ./nginx.conf:/etc/nginx/nginx.conf:ro - ./ssl:/etc/nginx/ssl:ro depends_on: - frontend - api

frontend: image: react-app:latest networks: - public - frontend-tier environment: API_URL: http://api:3000

api: image: node-api:latest networks: - frontend-tier - backend-tier environment: DATABASE_URL: postgresql://postgres:5432/app REDIS_URL: redis://cache:6379 QUEUE_URL: amqp://rabbitmq:5672 depends_on: - database - cache - queue

worker: image: node-worker:latest networks: - backend-tier environment: DATABASE_URL: postgresql://postgres:5432/app QUEUE_URL: amqp://rabbitmq:5672 depends_on: - database - queue deploy: replicas: 3

database: image: postgres:15-alpine networks: - backend-tier environment: POSTGRES_PASSWORD: secret POSTGRES_DB: app volumes: - pgdata:/var/lib/postgresql/data

cache: image: redis:7-alpine networks: - backend-tier command: redis-server --appendonly yes volumes: - redis-data:/data

queue: image: rabbitmq:3-management-alpine networks: - backend-tier - management ports: - "15672:15672" # Management UI environment: RABBITMQ_DEFAULT_USER: admin RABBITMQ_DEFAULT_PASS: secret volumes: - rabbitmq-data:/var/lib/rabbitmq

monitoring: image: prometheus:latest networks: - management ports: - "9090:9090" volumes: - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro - prometheus-data:/prometheus

networks: public: driver: bridge frontend-tier: driver: bridge internal: true backend-tier: driver: bridge internal: true management: driver: bridge

volumes: pgdata: redis-data: rabbitmq-data: prometheus-data:

Network segmentation:

• Public: Internet-facing services (nginx, frontend)

• Frontend-tier: Frontend and API communication

• Backend-tier: API, workers, databases, cache, queue

• Management: Monitoring and administration tools

Port Publishing Strategies

Control how services expose ports:

version: '3.8'

services:

Short syntax - host:container

web: image: nginx:alpine ports: - "80:80" - "443:443" networks: - public

Long syntax with protocol specification

api: image: node:18-alpine ports: - target: 3000 published: 3000 protocol: tcp mode: host networks: - app-network

Random host port

app: image: myapp:latest ports: - "3000" # Docker assigns random host port networks: - app-network

Bind to specific host interface

admin: image: admin-panel:latest ports: - "127.0.0.1:8080:80" # Only accessible from localhost networks: - admin-network

UDP protocol

dns: image: bind9:latest ports: - "53:53/udp" - "53:53/tcp" networks: - dns-network

Range of ports

streaming: image: rtmp-server:latest ports: - "1935:1935" - "8080-8089:8080-8089" networks: - streaming-network

networks: public: app-network: admin-network: internal: true dns-network: streaming-network:

Container Communication Patterns

Request-Response Pattern

version: '3.8'

services: gateway: image: nginx:alpine networks: - frontend ports: - "80:80" volumes: - ./nginx-gateway.conf:/etc/nginx/nginx.conf:ro

service-a: image: service-a:latest networks: - frontend - backend environment: SERVICE_B_URL: http://service-b:8080 DATABASE_URL: postgresql://db:5432/service_a

service-b: image: service-b:latest networks: - frontend - backend environment: DATABASE_URL: postgresql://db:5432/service_b

database: image: postgres:15-alpine networks: - backend environment: POSTGRES_PASSWORD: secret volumes: - pgdata:/var/lib/postgresql/data

networks: frontend: driver: bridge backend: driver: bridge internal: true

volumes: pgdata:

Pub-Sub Pattern

version: '3.8'

services: publisher: image: publisher:latest networks: - messaging environment: REDIS_URL: redis://redis:6379 depends_on: - redis

subscriber-1: image: subscriber:latest networks: - messaging environment: REDIS_URL: redis://redis:6379 SUBSCRIBER_ID: "1" depends_on: - redis

subscriber-2: image: subscriber:latest networks: - messaging environment: REDIS_URL: redis://redis:6379 SUBSCRIBER_ID: "2" depends_on: - redis

redis: image: redis:7-alpine networks: - messaging command: redis-server --appendonly yes volumes: - redis-data:/data

networks: messaging: driver: bridge driver_opts: com.docker.network.bridge.enable_icc: "true"

volumes: redis-data:

Network Troubleshooting Configuration

Enable debugging and monitoring:

version: '3.8'

services: app: image: myapp:latest networks: app-network: aliases: - primary-app cap_add: - NET_ADMIN - NET_RAW

debug: image: nicolaka/netshoot:latest networks: - app-network command: sleep infinity cap_add: - NET_ADMIN - NET_RAW stdin_open: true tty: true

database: image: postgres:15-alpine networks: app-network: aliases: - db environment: POSTGRES_PASSWORD: secret

networks: app-network: driver: bridge driver_opts: com.docker.network.bridge.enable_ip_masquerade: "true" com.docker.network.driver.mtu: "1500" ipam: driver: default config: - subnet: 172.28.0.0/16

Debug commands:

Enter debug container

docker compose exec debug bash

Test connectivity

ping app curl http://app:8080/health

Check DNS resolution

nslookup app dig app

Network scanning

nmap -p- app

Trace route

traceroute app

Monitor traffic

tcpdump -i eth0 -n

IPv6 Networking

Enable IPv6 support:

version: '3.8'

services: web: image: nginx:alpine networks: - ipv6-network ports: - "80:80"

api: image: node:18-alpine networks: ipv6-network: ipv6_address: 2001:db8:1::10

database: image: postgres:15-alpine networks: ipv6-network: ipv6_address: 2001:db8:1::20 environment: POSTGRES_PASSWORD: secret

networks: ipv6-network: driver: bridge enable_ipv6: true ipam: driver: default config: - subnet: 172.28.0.0/16 - subnet: 2001:db8:1::/64

When to Use This Skill

Use docker-compose-networking when you need to:

• Configure custom network topologies for multi-container applications

• Implement network segmentation and service isolation

• Set up service discovery and inter-service communication

• Design secure network architectures with frontend/backend separation

• Configure static IP addresses for services

• Connect to external Docker networks

• Implement complex microservices communication patterns

• Troubleshoot network connectivity issues

• Configure DNS resolution and hostname aliases

• Set up pub-sub or message queue architectures

• Enable IPv6 networking

• Optimize network performance with host networking

• Configure port publishing and exposure strategies

Best Practices

Use Custom Networks for Isolation: Always create custom networks instead of relying solely on the default network for better security and organization.

Implement Network Segmentation: Separate frontend, backend, and data tiers into different networks to limit attack surface.

Use Internal Networks: Mark backend networks as internal: true to prevent external access to sensitive services like databases.

Prefer Service Names Over IPs: Use Docker's built-in DNS and service names instead of hardcoding IP addresses for maintainability.

Configure Health Checks: Implement health checks to ensure services are ready before routing traffic to them.

Use Network Aliases: Define meaningful aliases for services to support multiple naming conventions and easier migration.

Avoid Host Networking Unless Necessary: Use bridge networks by default; host networking should only be used for specific performance requirements.

Document Network Architecture: Clearly comment your network design and document which services can communicate with each other.

Use Depends_on Wisely: Combine depends_on with health checks to ensure services start in the correct order.

Implement Least Privilege: Only expose ports that absolutely need to be accessible from outside the Docker network.

Use Environment Variables for URLs: Configure service endpoints through environment variables for flexibility across environments.

Test Network Isolation: Regularly verify that services can only communicate through intended network paths.

Configure Appropriate MTU: Set MTU values based on your network infrastructure to avoid fragmentation issues.

Use External Networks for Shared Resources: When multiple Compose projects need to communicate, use external networks rather than duplicating services.

Monitor Network Performance: Use tools like docker stats and dedicated monitoring containers to track network usage and identify bottlenecks.

Common Pitfalls

Exposing All Services Publicly: Don't publish ports for services that should only be accessed internally; use networks instead of port publishing.

Hardcoding IP Addresses: Avoid static IP addresses unless absolutely necessary; rely on service discovery instead.

Using Default Network Only: Not creating custom networks misses opportunities for proper segmentation and isolation.

Ignoring Network Modes: Using the wrong network mode (bridge vs host vs overlay) for your use case can cause connectivity or performance issues.

Missing Network Dependencies: Not properly configuring depends_on can cause services to fail when trying to connect to unavailable services.

Overusing Host Networking: Using network_mode: host unnecessarily breaks container isolation and portability.

Not Using Internal Networks: Failing to mark backend networks as internal leaves databases and sensitive services exposed.

Mixing Network Modes: Trying to publish ports or connect to networks when using network_mode: host causes configuration errors.

Circular Network Dependencies: Creating network dependencies that form a circle prevents containers from starting properly.

Ignoring DNS Configuration: Not configuring DNS properly can cause name resolution failures in containerized applications.

Subnet Conflicts: Using IP ranges that conflict with host or other Docker networks causes routing issues.

Not Testing Network Policies: Assuming network isolation works without testing can leave security vulnerabilities.

Exposing Management Interfaces: Publishing management ports (like RabbitMQ, Redis, PostgreSQL) without authentication or IP restrictions.

Using Links Instead of Networks: The deprecated links feature should be replaced with modern network configuration.

Ignoring Network Driver Options: Not configuring driver options like MTU or IP masquerade can cause subtle connectivity problems in production.

Resources

Official Documentation

• Docker Compose Networking

• Docker Network Drivers

• Docker DNS

Network Troubleshooting

• Nicolaka Netshoot - Network troubleshooting container

• Docker Network Inspect

Architecture Patterns

• Microservices Network Patterns

• Docker Security Best Practices

Tools

• Docker Network Commands

• Compose Network Reference