Networking
Networking
Docker networking provides isolation and name resolution between containers. Candidates must know the built-in drivers: bridge (default on a single host, private subnet with NAT), host (no isolation, shares the host network stack), none (no networking), overlay (multi-host, used by Swarm, with an encrypted option), and macvlan (container gets a MAC address on the physical network). User-defined bridge networks provide automatic DNS resolution by container name; the default bridge network does not, which is a frequent trap.
Port publishing (-p host:container) uses NAT or proxy rules; EXPOSE only documents a port and does not publish it. Understand the difference between the container's internal port and the host port, and that two containers cannot bind the same host port. In Swarm, the ingress routing mesh publishes a port on every node, while --publish mode=host binds only on the node running the task. Overlay networks rely on the control plane and need the relevant ports open between nodes.
DNS and service discovery: containers on the same user-defined network resolve each other by name or network alias; Swarm services resolve by service name and load-balance across tasks. Also know embedded DNS at 127.0.0.11 inside containers and how --dns overrides upstream resolvers.
Traps: expecting the default bridge to resolve names; confusing EXPOSE with -p; assuming host networking works identically across platforms; and forgetting that published ports bypass some network policies because traffic is DNAT'd.
Rule of thumb: always create a user-defined network for multi-container apps - you get name-based discovery and better isolation for free.