Docker Networking Deep Dive

1. The Under-the-Hood Plumbing: veth Pairs & iptables

When a container launches on a bridge network, the Docker daemon performs three Linux kernel configurations:

1. Creates a Virtual Ethernet Pair (veth): A virtual wire consisting of two peer endpoints. One endpoint is plugged into the software bridge on the host (e.g. docker0 or br-<id>), and the other endpoint is assigned inside the container's private NET namespace as eth0.
2. Allocates a Subnet IP Address: Assigns an IP (e.g. 172.18.0.2/16) to the container and configures a default gateway routing table.
3. Programs iptables / nftables NAT Rules: Sets up Network Address Translation (NAT) so outgoing packets from the container masquerade as the host machine's physical IP, and published inbound ports forward traffic directly to the container.

2. Network Drivers Comparison Matrix

3. User-Defined Bridge vs Default Bridge (The DNS Trap)

Always create a User-Defined Bridge Network. User-defined networks activate Docker's embedded DNS server listening at 127.0.0.11, allowing services to find each other by name:

# 1. Create a dedicated bridge network
docker network create --driver bridge app-tier

# 2. Start PostgreSQL with container name 'database'
docker run -d \
  --name database \
  --network app-tier \
  -e POSTGRES_PASSWORD=secret \
  postgres:16-alpine

# 3. Start API server on the same network
# The API connects to PostgreSQL using hostname 'database:5432'
docker run -d \
  --name api-service \
  --network app-tier \
  -e DB_URL="postgresql://postgres:secret@database:5432/app" \
  -p 8080:8080 \
  my-api:latest

# 4. Verify automatic DNS resolution inside the running API container:
docker exec api-service ping -c 2 database

4. Production Architecture: Multi-Tier Network Isolation

In production, never put your database on the same network as public-facing reverse proxies. Implement Defense-in-Depth by attaching containers to multiple distinct networks:

# 1. Create isolated network tiers
docker network create frontend-net
docker network create backend-net

# 2. Run Database strictly on backend-net (invisible from frontend)
docker run -d --name db --network backend-net postgres:16-alpine

# 3. Run API on frontend-net, then connect it to backend-net as well
docker run -d --name api --network frontend-net my-api:latest
docker network connect backend-net api

# 4. Run Nginx strictly on frontend-net
docker run -d --name proxy --network frontend-net -p 80:80 nginx:alpine

# Security Result: Even if the Nginx proxy is compromised, it cannot directly reach or ping the database!