DockerLab

Chapter 8 of 16 · Visual guide

Networking: CNM (sandbox, endpoint, network)

CNM is Docker's mental model for networking: three nouns that every driver implements.

key idea / Docker itselfcontainer / good pathhost / watch outproblem / blockedneutral

Three nouns

Learn these once and every later chapter (bridge, overlay, macvlan) is a variation.

The Container Network ModelA sandbox contains endpoints. Each endpoint joins exactly one network. Two sandboxes on the same network can talk.Sandbox A (container)Endpoint172.18.0.2Sandbox B (container)Endpoint172.18.0.3NetworkpaymentsSandboxthe computerEndpointthe network cardNetworkthe switch
Sandbox = the computer, endpoint = its network card, network = the switch.
ObjectWhat it isReal-world analogyYou see it as
Sandboxthe container network namespacea computerdocker inspect → NetworkSettings
Endpointa virtual interface with IP and MACa network cardan entry under Networks
Networka group of endpoints that can talka switchdocker network ls

A container on two networks

One sandbox, two endpointsThe api container has two endpoints. One is on the payments network, one on the default bridge, so it has two IP addresses.Sandbox: container apiEndpoint 1172.18.0.2Endpoint 2172.17.0.2Network: paymentsuser-defined bridgeNetwork: bridgedefault docker0
docker network connect adds an endpoint. It does not replace the first one.

Building a connection

How it is built, step by stepnetwork createpaymentsrun --networkpaymentsDocker makesan endpointPlugs sandboxinto network
Docker creates the endpoint and plugs the sandbox in; you only name the network.

Try it yourself

  1. Step 1 · Create the network, then one container

    The sandbox is the container. This command gives it one endpoint, on the network named payments.

    $ docker network create payments
$ docker run -d --name api --rm --network payments alpine:3.20 sleep 300
  2. Step 2 · Read that endpoint 
    $ docker inspect -f '{{range $name, $net := .NetworkSettings.Networks}}{{$name}} {{$net.IPAddress}}{{println}}{{end}}' api
payments 172.18.0.2
  3. Step 3 · Add a second endpoint

    network connect does not replace the first address. The sandbox now has two.

    $ docker network connect bridge api
$ docker inspect -f '{{range $name, $net := .NetworkSettings.Networks}}{{$name}} {{$net.IPAddress}}{{println}}{{end}}' api
payments 172.18.0.2
bridge 172.17.0.2
$ docker stop api
$ docker network rm payments

Recap

Quick check

You run docker network connect bridge api on a container already on payments. How many IPs does it have?
Show answer

Two. Connecting adds a second endpoint on the bridge network; the first endpoint stays.