Troubleshooting Network Connectivity Between Containers

Use diagnostic tools like ping and netcat within containers to verify DNS resolution and path availability across different network segments.

In this lesson, you will learn how to verify connectivity and resolve communication issues between containers using standard diagnostic tools.

When you define a multi-container architecture, containers often fail to talk to each other due to DNS resolution errors or incorrect network isolation. Before you assume your application code is broken, you must verify the network path between your containers.

Diagnostic Tools

The most reliable way to troubleshoot is to execute diagnostic commands directly inside the container environment. Since many minimal production images lack tools, you might need to install them temporarily or use a sidecar pattern.

ping: Used to check if the destination container is reachable at the IP level.
netcat (nc): Used to verify if a specific port (like 80 or 3306) is actually open and accepting connections on the target service.

Practical Workflow

If web-app cannot reach db-service, you can test the path from inside the web-app container:

# Verify DNS resolution
docker exec web-app ping db-service

# Verify port availability
docker exec web-app nc -zv db-service 3306

If ping fails, your containers are likely not on the same Docker network, or there is an issue with the Docker embedded DNS service. If ping succeeds but nc fails, it means the network path is open, but the db-service process is either not listening on port 3306 or is blocked by local firewall rules inside that container.

Step-by-Step Troubleshooting

Check Network Membership: Run docker inspect <container_id> to ensure both containers are attached to the same user-defined bridge network.
Test DNS: Use the service name defined in your docker-compose.yml. Docker’s embedded DNS should resolve the service name to the internal container IP automatically.
Validate Port: Ensure your application inside the target container is bound to 0.0.0.0 (all interfaces) rather than 127.0.0.1 (localhost only), otherwise the container will remain unreachable from the network.

Key Takeaway: Use ping to verify path connectivity via DNS and netcat to confirm the destination application is actively listening on the expected port.