Bridge Networks — a mini-LAN on one host

Every container needs an IP address. A bridge network is the private mini-LAN Docker quietly builds inside your machine so the containers on it can find one another.

What a bridge network is

A bridge network is a virtual switch that the container runtime sets up for you. Attach a container to a bridge and it picks up a private IP on that bridge's subnet — and from there it can reach the other containers on the same bridge directly.

Two containers on a user-defined bridge

The two built-in bridges

	default `bridge`	user-defined bridge
Auto-attached?	Yes, if you don't specify a network	Only when you ask
Name-based DNS between containers?	❌ no	✅ yes
Isolation between containers?	Weak	Strong (per-network)
Recommended?	Only for one-off experiments	Always for real apps

Always create a user-defined bridge

Container A can reach Container B by name (db instead of 172.20.0.3) — but only on a user-defined bridge. The good news: Docker Compose sets one of these up for every project without you asking.

Try it yourself

# Create a bridge network
docker network create my-app-net

# Run a Postgres container on it
docker run -d --name db --network my-app-net \
  -e POSTGRES_PASSWORD=secret postgres:16

# Run a web app on the same network
docker run -d --name web --network my-app-net \
  -e DATABASE_URL=postgres://postgres:secret@db:5432/postgres \
  my-app:latest

# Verify the web container can resolve "db"
docker exec web ping -c 2 db

Here's the same thing in Docker Compose, which quietly handles the bridge for you:

services:
  web:
    image: my-app:latest
    environment:
      DATABASE_URL: postgres://postgres:secret@db:5432/postgres
    depends_on: [db]
  db:
    image: postgres:16
    environment:
      POSTGRES_PASSWORD: secret

Under the hood

Under it all, Docker leans on the Linux kernel's bridge networking primitive (docker0 is the default one). Each container gets a virtual ethernet pair (veth) — one end sits inside the container, the other plugs into the bridge. Traffic between two containers hops veth → bridge → veth. Anything headed for the outside world gets NAT'd through the host.

Other single-host network modes

Mode	What it does
`bridge` (default)	Container gets its own IP on a private bridge — the usual choice.
`host`	Container shares the host's network stack. Fast, but you lose per-container isolation.
`none`	Container has no network. Useful for offline batch jobs.
`macvlan`	Container gets its own MAC and looks like a physical host on the LAN.
`container:<name>`	Share another container's stack — Kubernetes pods use exactly this trick between containers in the same pod.

Key takeaways

A bridge network is a virtual LAN on your host that containers plug into.
User-defined bridges give you name-based DNS between containers — always use them.
Compose builds a bridge for each project automatically.
Other modes (host, none, macvlan) exist for special cases.