Advanced
Containers & Virtualization
#container-networking#bridge-network#overlay#service-discovery
Container Networking Vocabulary
5 exercises — Master the English vocabulary of container networking: network drivers, port binding, DNS service discovery, VXLAN overlays, and network isolation.
0 / 25 completed
1 / 25
A developer asks: "I need the containers in my app — a web server, an API, and a cache — to communicate with each other on the same Docker host but be isolated from external network traffic unless I explicitly publish a port. Which Docker network driver should I use?"
Which driver is correct for this single-host, internal communication requirement?
The bridge driver is the correct choice for single-host container-to-container networking with isolation.
Docker's built-in network drivers serve different purposes:
• bridge (default) — software bridge on the host; containers on the same bridge network communicate; isolated from host network unless ports are published via
• host — removes network namespace isolation; the container shares the host's network stack; better performance but zero network isolation
• overlay — multi-host networking across a Docker Swarm cluster; uses VXLAN encapsulation
• macvlan — containers appear as physical NICs on the LAN; used for apps needing direct L2 access (e.g., network appliances)
• none — no networking at all; used for maximum isolation or custom network setups
Key vocabulary:
• bridge network — a virtual network connecting containers on a single Docker host
• network driver — the software plugin that implements a specific networking topology in Docker
• published port — a host:container port mapping created with
• network namespace — the kernel isolation boundary that gives each container its own network stack
Docker's built-in network drivers serve different purposes:
• bridge (default) — software bridge on the host; containers on the same bridge network communicate; isolated from host network unless ports are published via
-p• host — removes network namespace isolation; the container shares the host's network stack; better performance but zero network isolation
• overlay — multi-host networking across a Docker Swarm cluster; uses VXLAN encapsulation
• macvlan — containers appear as physical NICs on the LAN; used for apps needing direct L2 access (e.g., network appliances)
• none — no networking at all; used for maximum isolation or custom network setups
Key vocabulary:
• bridge network — a virtual network connecting containers on a single Docker host
• network driver — the software plugin that implements a specific networking topology in Docker
• published port — a host:container port mapping created with
-p that exposes a container port to external traffic• network namespace — the kernel isolation boundary that gives each container its own network stack
2 / 25
A docker run command includes the flag -p 8080:3000. A new team member asks: "I need to test the Node.js API from my browser. Which URL should I open?"
What is the correct answer?
Port binding notation is always HOST_PORT:CONTAINER_PORT — connect on the left number.
The
The
Key vocabulary:
• port binding — mapping a host port to a container port, published with
• host port — the port exposed on the Docker host machine (left side of the binding)
• container port — the port the application listens on inside the container (right side of the binding)
• EXPOSE — a Dockerfile instruction documenting the container's listening port; does NOT publish to the host
The
-p 8080:3000 flag instructs Docker to forward traffic arriving at host port 8080 into the container at port 3000. From outside the container (your browser, curl, other services on the host), you always use the left-side number: localhost:8080. The application inside the container still listens on 3000 unchanged.The
EXPOSE Dockerfile instruction is often confused with port publishing. EXPOSE 3000 is documentation only — it tells humans and tooling which port the app uses, but it does NOT publish the port to the host. Only -p (or ports: in Compose) publishes a port.Key vocabulary:
• port binding — mapping a host port to a container port, published with
-p HOST:CONTAINER• host port — the port exposed on the Docker host machine (left side of the binding)
• container port — the port the application listens on inside the container (right side of the binding)
• EXPOSE — a Dockerfile instruction documenting the container's listening port; does NOT publish to the host
3 / 25
A microservices project uses Docker Compose. The api-gateway service's environment variable is set to PAYMENT_URL=http://payment-service:3000. When a teammate asks "How does the hostname payment-service resolve inside the api-gateway container?", the correct answer is:
Docker's embedded DNS server resolves container and service names automatically within a shared network.
Every container connected to a user-defined Docker network gets DNS configured to use Docker's embedded resolver at
This service discovery is network-scoped: only containers on the same Docker network can resolve each other by name. In Docker Swarm, the embedded DNS also provides virtual IP (VIP) load balancing across service replicas transparently.
Key vocabulary:
• embedded DNS — Docker's built-in resolver (127.0.0.11) that resolves container and service names to IPs
• service discovery — the ability for services to locate each other by name without hardcoded IP addresses
• DNS alias — Docker Compose assigns each service's name as a DNS alias resolvable within the same network
• network scope — container name DNS resolution is scoped to the containers sharing the same Docker network
Every container connected to a user-defined Docker network gets DNS configured to use Docker's embedded resolver at
127.0.0.11. This resolver maps container names and Compose service names to their current internal IP addresses. Because container IPs change on restart, resolving by name (not IP) is the correct approach.This service discovery is network-scoped: only containers on the same Docker network can resolve each other by name. In Docker Swarm, the embedded DNS also provides virtual IP (VIP) load balancing across service replicas transparently.
Key vocabulary:
• embedded DNS — Docker's built-in resolver (127.0.0.11) that resolves container and service names to IPs
• service discovery — the ability for services to locate each other by name without hardcoded IP addresses
• DNS alias — Docker Compose assigns each service's name as a DNS alias resolvable within the same network
• network scope — container name DNS resolution is scoped to the containers sharing the same Docker network
4 / 25
A Docker Swarm architect says: "We need containers on different physical hosts to communicate as if they're on the same LAN. We'll create an overlay network — it tunnels container traffic between hosts using VXLAN encapsulation."
What does VXLAN encapsulation provide?
VXLAN tunnels Layer-2 Ethernet frames over UDP so containers on different hosts appear on the same LAN.
VXLAN (Virtual Extensible LAN) solves the problem of running a virtual L2 network across physical L3 infrastructure. It encapsulates Ethernet frames in UDP datagrams with a VTEP (VXLAN Tunnel End Point) header. Containers on
Docker Swarm uses VXLAN-based overlay networks for all cross-node container communication. Kubernetes CNI plugins (Flannel, Calico BGP-less mode) use similar tunnelling. VXLAN does NOT provide encryption by default — a separate layer (WireGuard, IPsec, mutual TLS) is needed for encrypted overlay networks.
Key vocabulary:
• overlay network — a virtual network built on top of an existing physical network infrastructure
• VXLAN — Virtual Extensible LAN; encapsulates Ethernet frames in UDP for cross-host container networking
• VTEP — VXLAN Tunnel End Point; the host-level component that encapsulates and decapsulates VXLAN traffic
• multi-host networking — container communication spanning multiple Docker hosts or Kubernetes nodes
• encapsulation — wrapping a network frame inside another packet to traverse an incompatible network
VXLAN (Virtual Extensible LAN) solves the problem of running a virtual L2 network across physical L3 infrastructure. It encapsulates Ethernet frames in UDP datagrams with a VTEP (VXLAN Tunnel End Point) header. Containers on
host-A and host-B communicate as if they share one Ethernet segment — the physical L3 network between the hosts is transparent to them.Docker Swarm uses VXLAN-based overlay networks for all cross-node container communication. Kubernetes CNI plugins (Flannel, Calico BGP-less mode) use similar tunnelling. VXLAN does NOT provide encryption by default — a separate layer (WireGuard, IPsec, mutual TLS) is needed for encrypted overlay networks.
Key vocabulary:
• overlay network — a virtual network built on top of an existing physical network infrastructure
• VXLAN — Virtual Extensible LAN; encapsulates Ethernet frames in UDP for cross-host container networking
• VTEP — VXLAN Tunnel End Point; the host-level component that encapsulates and decapsulates VXLAN traffic
• multi-host networking — container communication spanning multiple Docker hosts or Kubernetes nodes
• encapsulation — wrapping a network frame inside another packet to traverse an incompatible network
5 / 25
A security review reports: "Container A (payment service) can reach Container B (internal admin panel) because they're on the same default bridge network. The payment service should have no route to the admin panel — place them on separate networks."
Which statement best describes how Docker network isolation works?
Docker network isolation is topology-based: same network = can communicate, different networks = cannot.
Docker's network model enforces isolation at the network boundary. Create separate networks for different trust domains — e.g., a
A container that needs to bridge two segments (e.g., an API gateway connecting frontend to backend) can be attached to both networks explicitly. Best practice: no container should be connected to networks it doesn't use — this limits blast radius if a container is compromised.
Key vocabulary:
• network micro-segmentation — dividing a network into small isolated segments with controlled access between them
• least-privilege networking — connecting a container only to the networks it actually needs
• intra-network communication — traffic between containers sharing the same Docker network (permitted by default)
• cross-network communication — traffic between containers on different Docker networks (blocked by default)
• blast radius — the scope of impact if a single container or service is compromised
Docker's network model enforces isolation at the network boundary. Create separate networks for different trust domains — e.g., a
frontend network, a backend network, a db network — and connect each container only to the networks it legitimately needs. This is network micro-segmentation without writing iptables or firewall rules manually.A container that needs to bridge two segments (e.g., an API gateway connecting frontend to backend) can be attached to both networks explicitly. Best practice: no container should be connected to networks it doesn't use — this limits blast radius if a container is compromised.
Key vocabulary:
• network micro-segmentation — dividing a network into small isolated segments with controlled access between them
• least-privilege networking — connecting a container only to the networks it actually needs
• intra-network communication — traffic between containers sharing the same Docker network (permitted by default)
• cross-network communication — traffic between containers on different Docker networks (blocked by default)
• blast radius — the scope of impact if a single container or service is compromised
6 / 25
The correct answer is
docker exec. This command allows you to execute commands within a running container's environment without modifying the container itself or exposing it to external networks. Options B and D are incorrect because they involve port exposure or creating a separate debugging container which isn't the most efficient method for immediate shell access. Option C is also wrong as docker exec provides direct shell access, not network connection through a new named network.7 / 25
Alex: "Hey team, I'm deploying a new service that needs to access our database. It's running in a container and we want to ensure it's securely isolated from the rest of the network. We're using Kubernetes. What's the best way to achieve this?"Kubernetes Network Policies provide a powerful mechanism for controlling network traffic at the pod level. Rather than relying on default bridge networks or exposing ports directly, Network Policies allow you to define precisely which pods can communicate with each other based on labels – in this case, labeling your database service and applying a policy that only allows communication from the new deployment's service. This approach significantly enhances security by minimizing the attack surface and preventing unauthorized access.
8 / 25
Liam: "Okay team, we've just deployed a new service, EchoService, that needs to regularly ping an external monitoring endpoint. We're using Docker Compose and want the EchoService container to be able to make these outbound connections without any firewall restrictions within our Docker network. What is the *most* appropriate way to configure this?"The correct answer is using the bridge driver within a custom Docker network. The bridge driver creates a private network accessible only by containers connected to it. This isolates
EchoService's outbound traffic from the host and other containers, preventing unintended connections and simplifying firewall configurations. Options A and B are incorrect because they don't leverage Docker's networking features for isolation; option C is also wrong as using the bridge driver with a custom network provides the necessary control over routing.9 / 25
You're troubleshooting a deployment where your application's frontend container can't reach the backend API container. The containers are running in Kubernetes and you've confirmed they're on separate namespaces. Examining the network policies, you notice one that denies all egress traffic from the frontend namespace. What is the *most* likely reason for this connectivity issue?
David, a senior engineer, says: 'Let's investigate! We need to ensure our frontend can communicate with the backend, but we also want to maintain security.'
David, a senior engineer, says: 'Let's investigate! We need to ensure our frontend can communicate with the backend, but we also want to maintain security.'
Kubernetes Network Policies provide granular control over traffic flow between pods. The scenario describes a restrictive policy denying all egress traffic from the frontend namespace – this is the primary cause of the connectivity problem. Options A and C are incorrect because they describe alternative issues that wouldn't directly block outbound traffic. Option D suggests a plugin issue, which while possible, is less likely given the explicitly defined Network Policy.
10 / 25
During a troubleshooting session for a microservice deployment using Docker Compose, the development team is experiencing intermittent connectivity issues between two services, `web_app` and `api_gateway`. The logs show that `api_gateway` sometimes fails to resolve the hostname of `web_app`, resulting in connection timeouts. After examining their network configuration, the team discovers they've created a custom Docker Compose network named 'my_network'. John, a developer, asks: 'I've defined this network but it seems like
api_gateway isn't always able to find web_app. What could be causing this intermittent resolution problem?'The core issue here is Docker Compose's default DNS resolution behavior within custom networks. By default, Docker Compose doesn't always guarantee that containers on the same network will have properly configured DNS resolvers, particularly when relying solely on the host's DNS. This can lead to intermittent failures in resolving container names, as the containers aren't consistently able to find each other. Option A is incorrect because memory issues typically manifest differently (e.g., high CPU usage). Options C and D are also inaccurate; Docker Compose doesn't inherently block traffic or dynamically change IP addresses.
11 / 25
The correct answer is
docker exec. This command allows you to execute commands within a running container's environment without modifying the container itself or exposing it to external networks. Options B and D are incorrect because they involve port exposure or creating a separate debugging container which isn't the most efficient method for immediate shell access. Option C is also wrong as docker exec provides direct shell access, not network connection through a new named network.12 / 25
Alex: "Hey team, I'm deploying a new service that needs to access our database. It's running in a container and we want to ensure it's securely isolated from the rest of the network. We're using Kubernetes. What's the best way to achieve this?"Kubernetes Network Policies provide a powerful mechanism for controlling network traffic at the pod level. Rather than relying on default bridge networks or exposing ports directly, Network Policies allow you to define precisely which pods can communicate with each other based on labels – in this case, labeling your database service and applying a policy that only allows communication from the new deployment's service. This approach significantly enhances security by minimizing the attack surface and preventing unauthorized access.
13 / 25
Liam: "Okay team, we've just deployed a new service, EchoService, that needs to regularly ping an external monitoring endpoint. We're using Docker Compose and want the EchoService container to be able to make these outbound connections without any firewall restrictions within our Docker network. What is the *most* appropriate way to configure this?"The correct answer is using the bridge driver within a custom Docker network. The bridge driver creates a private network accessible only by containers connected to it. This isolates
EchoService's outbound traffic from the host and other containers, preventing unintended connections and simplifying firewall configurations. Options A and B are incorrect because they don't leverage Docker's networking features for isolation; option C is also wrong as using the bridge driver with a custom network provides the necessary control over routing.14 / 25
You're troubleshooting a deployment where your application's frontend container can't reach the backend API container. The containers are running in Kubernetes and you've confirmed they're on separate namespaces. Examining the network policies, you notice one that denies all egress traffic from the frontend namespace. What is the *most* likely reason for this connectivity issue?
David, a senior engineer, says: 'Let's investigate! We need to ensure our frontend can communicate with the backend, but we also want to maintain security.'
David, a senior engineer, says: 'Let's investigate! We need to ensure our frontend can communicate with the backend, but we also want to maintain security.'
Kubernetes Network Policies provide granular control over traffic flow between pods. The scenario describes a restrictive policy denying all egress traffic from the frontend namespace – this is the primary cause of the connectivity problem. Options A and C are incorrect because they describe alternative issues that wouldn't directly block outbound traffic. Option D suggests a plugin issue, which while possible, is less likely given the explicitly defined Network Policy.
15 / 25
During a troubleshooting session for a microservice deployment using Docker Compose, the development team is experiencing intermittent connectivity issues between two services, `web_app` and `api_gateway`. The logs show that `api_gateway` sometimes fails to resolve the hostname of `web_app`, resulting in connection timeouts. After examining their network configuration, the team discovers they've created a custom Docker Compose network named 'my_network'. John, a developer, asks: 'I've defined this network but it seems like
api_gateway isn't always able to find web_app. What could be causing this intermittent resolution problem?'The core issue here is Docker Compose's default DNS resolution behavior within custom networks. By default, Docker Compose doesn't always guarantee that containers on the same network will have properly configured DNS resolvers, particularly when relying solely on the host's DNS. This can lead to intermittent failures in resolving container names, as the containers aren't consistently able to find each other. Option A is incorrect because memory issues typically manifest differently (e.g., high CPU usage). Options C and D are also inaccurate; Docker Compose doesn't inherently block traffic or dynamically change IP addresses.
16 / 25
The correct answer is
docker exec. This command allows you to execute commands within a running container's environment without modifying the container itself or exposing it to external networks. Options B and D are incorrect because they involve port exposure or creating a separate debugging container which isn't the most efficient method for immediate shell access. Option C is also wrong as docker exec provides direct shell access, not network connection through a new named network.17 / 25
Alex: "Hey team, I'm deploying a new service that needs to access our database. It's running in a container and we want to ensure it's securely isolated from the rest of the network. We're using Kubernetes. What's the best way to achieve this?"Kubernetes Network Policies provide a powerful mechanism for controlling network traffic at the pod level. Rather than relying on default bridge networks or exposing ports directly, Network Policies allow you to define precisely which pods can communicate with each other based on labels – in this case, labeling your database service and applying a policy that only allows communication from the new deployment's service. This approach significantly enhances security by minimizing the attack surface and preventing unauthorized access.
18 / 25
Liam: "Okay team, we've just deployed a new service, EchoService, that needs to regularly ping an external monitoring endpoint. We're using Docker Compose and want the EchoService container to be able to make these outbound connections without any firewall restrictions within our Docker network. What is the *most* appropriate way to configure this?"The correct answer is using the bridge driver within a custom Docker network. The bridge driver creates a private network accessible only by containers connected to it. This isolates
EchoService's outbound traffic from the host and other containers, preventing unintended connections and simplifying firewall configurations. Options A and B are incorrect because they don't leverage Docker's networking features for isolation; option C is also wrong as using the bridge driver with a custom network provides the necessary control over routing.19 / 25
You're troubleshooting a deployment where your application's frontend container can't reach the backend API container. The containers are running in Kubernetes and you've confirmed they're on separate namespaces. Examining the network policies, you notice one that denies all egress traffic from the frontend namespace. What is the *most* likely reason for this connectivity issue?
David, a senior engineer, says: 'Let's investigate! We need to ensure our frontend can communicate with the backend, but we also want to maintain security.'
David, a senior engineer, says: 'Let's investigate! We need to ensure our frontend can communicate with the backend, but we also want to maintain security.'
Kubernetes Network Policies provide granular control over traffic flow between pods. The scenario describes a restrictive policy denying all egress traffic from the frontend namespace – this is the primary cause of the connectivity problem. Options A and C are incorrect because they describe alternative issues that wouldn't directly block outbound traffic. Option D suggests a plugin issue, which while possible, is less likely given the explicitly defined Network Policy.
20 / 25
During a troubleshooting session for a microservice deployment using Docker Compose, the development team is experiencing intermittent connectivity issues between two services, `web_app` and `api_gateway`. The logs show that `api_gateway` sometimes fails to resolve the hostname of `web_app`, resulting in connection timeouts. After examining their network configuration, the team discovers they've created a custom Docker Compose network named 'my_network'. John, a developer, asks: 'I've defined this network but it seems like
api_gateway isn't always able to find web_app. What could be causing this intermittent resolution problem?'The core issue here is Docker Compose's default DNS resolution behavior within custom networks. By default, Docker Compose doesn't always guarantee that containers on the same network will have properly configured DNS resolvers, particularly when relying solely on the host's DNS. This can lead to intermittent failures in resolving container names, as the containers aren't consistently able to find each other. Option A is incorrect because memory issues typically manifest differently (e.g., high CPU usage). Options C and D are also inaccurate; Docker Compose doesn't inherently block traffic or dynamically change IP addresses.
21 / 25
The correct answer is
docker exec. This command allows you to execute commands within a running container's environment without modifying the container itself or exposing it to external networks. Options B and D are incorrect because they involve port exposure or creating a separate debugging container which isn't the most efficient method for immediate shell access. Option C is also wrong as docker exec provides direct shell access, not network connection through a new named network.22 / 25
Alex: "Hey team, I'm deploying a new service that needs to access our database. It's running in a container and we want to ensure it's securely isolated from the rest of the network. We're using Kubernetes. What's the best way to achieve this?"Kubernetes Network Policies provide a powerful mechanism for controlling network traffic at the pod level. Rather than relying on default bridge networks or exposing ports directly, Network Policies allow you to define precisely which pods can communicate with each other based on labels – in this case, labeling your database service and applying a policy that only allows communication from the new deployment's service. This approach significantly enhances security by minimizing the attack surface and preventing unauthorized access.
23 / 25
Liam: "Okay team, we've just deployed a new service, EchoService, that needs to regularly ping an external monitoring endpoint. We're using Docker Compose and want the EchoService container to be able to make these outbound connections without any firewall restrictions within our Docker network. What is the *most* appropriate way to configure this?"The correct answer is using the bridge driver within a custom Docker network. The bridge driver creates a private network accessible only by containers connected to it. This isolates
EchoService's outbound traffic from the host and other containers, preventing unintended connections and simplifying firewall configurations. Options A and B are incorrect because they don't leverage Docker's networking features for isolation; option C is also wrong as using the bridge driver with a custom network provides the necessary control over routing.24 / 25
You're troubleshooting a deployment where your application's frontend container can't reach the backend API container. The containers are running in Kubernetes and you've confirmed they're on separate namespaces. Examining the network policies, you notice one that denies all egress traffic from the frontend namespace. What is the *most* likely reason for this connectivity issue?
David, a senior engineer, says: 'Let's investigate! We need to ensure our frontend can communicate with the backend, but we also want to maintain security.'
David, a senior engineer, says: 'Let's investigate! We need to ensure our frontend can communicate with the backend, but we also want to maintain security.'
Kubernetes Network Policies provide granular control over traffic flow between pods. The scenario describes a restrictive policy denying all egress traffic from the frontend namespace – this is the primary cause of the connectivity problem. Options A and C are incorrect because they describe alternative issues that wouldn't directly block outbound traffic. Option D suggests a plugin issue, which while possible, is less likely given the explicitly defined Network Policy.
25 / 25
During a troubleshooting session for a microservice deployment using Docker Compose, the development team is experiencing intermittent connectivity issues between two services, `web_app` and `api_gateway`. The logs show that `api_gateway` sometimes fails to resolve the hostname of `web_app`, resulting in connection timeouts. After examining their network configuration, the team discovers they've created a custom Docker Compose network named 'my_network'. John, a developer, asks: 'I've defined this network but it seems like
api_gateway isn't always able to find web_app. What could be causing this intermittent resolution problem?'The core issue here is Docker Compose's default DNS resolution behavior within custom networks. By default, Docker Compose doesn't always guarantee that containers on the same network will have properly configured DNS resolvers, particularly when relying solely on the host's DNS. This can lead to intermittent failures in resolving container names, as the containers aren't consistently able to find each other. Option A is incorrect because memory issues typically manifest differently (e.g., high CPU usage). Options C and D are also inaccurate; Docker Compose doesn't inherently block traffic or dynamically change IP addresses.
Frequently Asked Questions
What does the "Container Networking Vocabulary" exercise practise?
Practice container networking vocabulary in English: Docker network drivers, port binding, embedded DNS, VXLAN overlay networks, and network isolation. 5 advanced exercises.
How many questions are in this exercise?
This exercise has 25 questions, each multiple-choice with a full explanation shown after you answer.
What English level is this exercise for?
This exercise is tagged Advanced. If the vocabulary feels difficult, browse the Containers & Virtualization category page for an easier module to start with.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free with no account, sign-up, or paywall.
Do I get feedback if I answer incorrectly?
Yes — whichever option you choose, right or wrong, you'll immediately see an explanation clarifying the correct term and why the other options don't fit.
Can I retry this exercise?
Yes — once you finish all the questions, a "Try again" button on the results screen resets the exercise so you can practise as many times as you like.
Do I need an account to track my progress?
No account is required. Your progress bar and score for this session are tracked in the browser as you go, but nothing is saved once you leave the page.
Is "Container Networking Vocabulary" part of a larger series?
Yes — it's one exercise in the Containers & Virtualization category on CoderSlingo. See the category page for the full list of related exercises on similar terminology.
Can I link directly to this exercise?
Yes — this exercise has its own permanent URL, so you can bookmark it or share the link directly with a colleague or study partner.
Where can I find more exercises like this one?
See the Containers & Virtualization category page for related exercises, or browse the main Exercises hub for other IT English topics.