In this lesson, you will learn how to create and manage custom bridge networks to enforce strict communication boundaries between your containers.
Why Default Networking Isn't Enough
By default, when you start containers, they often land on a shared bridge network. While convenient, this allows containers to talk to each other freely if they know each other’s IP addresses. In production environments, this "flat" networking is a security risk. If one container is compromised, the attacker has an open path to probe every other service on that host.
Implementing Isolated Bridge Networks
To solve this, we create User-Defined Bridge Networks. These networks act as logical silos. Containers attached to one network cannot communicate with containers on another, even if they are running on the same host, unless you explicitly connect them.
Creating and Connecting Networks
First, create your custom network:
docker network create --driver bridge frontend-net
docker network create --driver bridge backend-net
Now, launch your containers by assigning them to these specific silos:
# Launch a web server on the frontend network
docker run -d --name web-app --network frontend-net nginx
# Launch a database on the backend network
docker run -d --name db-service --network backend-net postgres
Because web-app and db-service are on different bridge networks, they are completely isolated from one another. The web-app container cannot resolve the hostname db-service nor ping its IP address. This isolation ensures that your database remains shielded from any traffic originating from the public-facing web tier, fulfilling the principle of least privilege at the network layer.
If you ever need a container to span two networks (for example, a proxy that needs to reach both), you can simply connect it to both networks using docker network connect. This gives you fine-grained control over exactly which services are "neighbors" and which are strangers.
Key Takeaway: User-defined bridge networks create logical boundaries that restrict inter-container communication by default, significantly reducing your attack surface within a single host.