- [Instructor] When we expose a container's port in Docker,
it creates a network path from, essentially,
the outside of that machine down through
the networking layers and into that container.
That's very well, and other containers can connect to it
by going out to the host, turning around,
and coming back in along that path.
It's useful, but there are more efficient ways
to go about it.
Docker offers an extensive set of networking options
for really controlling exactly how your containers
connect to each other, and making sure that
it's secure and just the way you want it.
For that, let's explore Docker's
virtual network features a bit, and see what we can do.
Let's take a look at the existing networks
and see what's there by default.
Docker network ls.
So we see three networks by default.
Bridge is the network used by containers
that don't specify a preference to be
put into any other network.
Host is when you want a container to not have
any network isolation at all.
This does have some security concerns.
And none is for when a container should have no networking.
All right, let's make a new network, just to play with.
Docker network create.
Let's call it learning.
Okay.
Now I've got a couple of terminals here.
Let's put some machines on that network.
Docker run, the usual, --rn -ti,
and now the interesting part.
- -net learning.
And let's give it a name.
Catserver.
- -name catserver.
Names are very useful when using private networks in Docker,
because different containers inside the network
can refer to each other by those names,
so it makes it very easy for them to find each other.
Now, let's just finish that off with the usual bits.
We're going to choose Ubuntu, 1404, and run Bash.
Okay, we have the catserver running.
Ping, I'm going to clear that.
Ping catserver.
All right, we can send traffic to ourself.
Is there anyone else here?
Ping dogserver.
Nope, no dogs here.
All right, over here, let's start up a dogserver.
Docker run --rn -ti, and again, --net learning.
I'll put it on the same network,
so they can find each other, and give it a name.
Dogserver, and finish it off.
Okay, now can we connect to that dogserver
from over here on the catserver on the left?
Why, yes.
In fact, we can do it both ways.
Nc -lp, ah, we can choose any port we want.
We don't have to expose them in advance.
I'll choose 1234 over here on the dog side, listen,
and then over here I'll do nc dogserver port 1234,
and let's say meow.
And then on the other side, let's say woof.
So they can communicate in both directions.
But that's just one network with two machines.
Let's make things more interesting.
I'm going to start up a new terminal here.
Let's make another network.
Docker network create catsonly.
This is a network only for cats.
Okay, now let's go ahead and put the cat machine
onto the cat network.
Docker network connect catsonly,
and then catserver.
Okay.
Now, over here, let's make things a little more interesting.
I'll start up another terminal, squeeze it down,
rearrange things a bit, squish the dogserver
over to the side, put the catserver in the middle.
And over here on the left, I'm going to start
the new member of our network.
Docker run --rn -ti --net,
and this is where I'm going to put on catsonly --name,
let's call it bobcatserver.
It's like a catserver, only moreso.
And run Bash.
Okay, so from here, I can do ping catserver,
and get data.
If I do ping dogserver,
traffic is not allowed.
From the catserver in the middle,
I can ping dogserver, hit Control + C, yep, it worked.
And bobcatserver.
Now, over here, on the dogserver,
we can still only make connections to catserver.
But we cannot connect to bobcatserver,
because the dogserver is not on the catsonly network.
There are many, many more options to this
that give you fine-grain control over
how things connect here.
We just showed enough of an example
to keep things interesting,
and to cover about 90% of the use cases.
The rest will be left up to experience.