Docker Network Isolation

What This Article Covers

• Standard bridge and custom networks.
• Internal networks without external communication.
• Network segmentation in Compose.
• Security benefits of isolation.
• Best practices for clean network architectures.

Introduction: Docker Network Isolation

Multiple containers often run on the same Docker host. Without isolation, they can see each other, ping one another, and communicate over open ports. For security-sensitive deployments, this poses real risks. Docker provides several network types that let you separate containers from each other. By placing databases, APIs, and public web services into distinct networks, you minimize risk exposure and keep your infrastructure organized.

This article walks through how to isolate Docker networks effectively.

Key Concepts

• Bridge: Docker’s standard network type.
• Overlay: Network for Swarm clusters.
• Host: Container uses the host’s network.
• None: No network access.
• Internal Network: No external communication allowed.
• Segmentation: Dividing infrastructure into logical network zones.
• Microsegmentation: Fine-grained isolation per service.
• Default Bridge: Docker’s built-in network.

The Default Bridge

By default, all containers land in the bridge network. They can reach each other via IP addresses as long as no firewall blocks them. Convenient, but not secure.

docker network ls

Custom Networks

docker network create app-net

Containers in the same custom network can reach each other by hostname through built-in DNS:

docker run -d --name web --network app-net nginx
docker run -d --name db --network app-net postgres

Internal Networks

Internal networks have no external access:

docker network create --internal backend-net

Containers on an internal network cannot reach the internet. Perfect for databases or internal APIs.

Compose Example

services:
  web:
    image: nginx
    networks:
      - frontend

  app:
    image: mein-app
    networks:
      - frontend
      - backend

  db:
    image: postgres
    networks:
      - backend

networks:
  frontend:
    driver: bridge
  backend:
    internal: true

The database is reachable only through app, not directly from frontend.

Don’t Publish Every Port

Only containers that need external access should expose ports:

services:
  db:
    image: postgres
    networks:
      - backend
    # No ports here

Block Internet for Specific Containers

Use network_mode: none:

services:
  batch:
    image: batch-processor
    network_mode: none

Alternatively, configure custom iptables rules.

Security Through Isolation

• Databases unreachable from the outside.
• Internal APIs remain hidden.
• Smaller attack surface.
• Simpler rules for firewalls and reverse proxies.
• Malware in one container spreads less easily.

Reverse Proxy as the Gateway

A public-facing Traefik or nginx instance forwards requests to the right network. Services behind it need no public ports of their own.

Best Practices

• Create one network per logical area.
• Place databases in an internal backend network.
• Publish ports sparingly.
• Supplement with host-level firewall rules.
• Maintain logging and monitoring across all networks.
• Allow only necessary connections.

Common Pitfalls

• Container on the wrong network: Check reachability.
• DNS not working: Custom networks provide DNS; the default bridge does not.
• Internal networks and updates: Container cannot download packages.
• Published ports in the wrong place: Security gap.
• Incorrect firewall rule: Container still reachable.

Further Reading

• BotServ.de Docker Networking
• BotServ.de Docker Resource Limits
• BotServ.de Docker Security
• BotServ.de Docker Reverse Proxy

FAQ: Docker Network Isolation

Are containers on the same Docker network isolated from each other? No, they can reach each other by default.

What is an internal network? A network with no external connectivity, typically for databases.

Do I need a separate network for each service? With multiple services, segmentation makes sense but is not mandatory.

Can I disconnect a container from the network entirely? Yes, using network_mode: none.

How does a container access the internet? Through the standard bridge or a custom network, but not through an internal network.

Sources and Further Reading

• Docker Network: https://docs.docker.com/network/
• Compose Networks: https://docs.docker.com/compose/networking/
• Bridge vs Overlay: https://docs.docker.com/network/bridge/

Summary: Docker Network Isolation

Docker network isolation is a straightforward yet powerful security measure. Custom networks and internal networks logically separate containers from one another. Databases and internal APIs belong in the backend; public services in the frontend. Publishing ports thoughtfully and restricting external access where unnecessary reduces your attack surface and keeps your infrastructure clear and manageable.