$ run as a normal user# run as root (or with sudo)
Know the network drivers
The driver decides how the container is connected.
| Driver | Meaning |
|---|---|
bridge (default) | A private network on the host, NAT to the outside |
| User-defined bridge | Like bridge, plus DNS by container name — use this |
host | No isolation: the container uses the host's network |
none | No network at all |
macvlan / ipvlan | The container gets an address on the physical LAN |
overlay | Across several hosts (Swarm) |
Use a user-defined network
Containers on the same user-defined network reach each other by name. Only the front service publishes a port.
docker network create shopnet
docker run -d --name db --network shopnet -e POSTGRES_PASSWORD=secret postgres:16
docker run -d --name api --network shopnet -e DATABASE_URL=postgres://postgres:secret@db:5432/postgres myorg/api:2.0
docker run -d --name web --network shopnet -p 8080:80 nginx:1.27
docker exec api getent hosts db
docker network inspect shopnet --format '{{range .Containers}}{{.Name}} {{.IPv4Address}}{{"\n"}}{{end}}'Remember
The database publishes no port. It is reachable only for containers on shopnet — a smaller attack surface.
Publish ports carefully
-p opens a port on the host. By default it listens on all host addresses.
docker run -d -p 8080:80 nginx:1.27
docker run -d -p 127.0.0.1:5432:5432 postgres:16
docker run -d -P nginx:1.27
docker port $(docker ps -lq)Watch out
Docker writes its own firewall (iptables/nftables) rules. A published port can be reachable from the internet even if your host firewall seems to block it. Bind to 127.0.0.1 when only local access is needed.
Debug container networking
Test from inside the container, step by step: name → IP → port.