Connect a Container to Two Networks

Sometimes one container has to talk to two groups that must not talk to each other: a proxy between the public network and a private back end, for example. Docker allows a container on several networks at once. This page builds that layout and proves who can reach whom.

Build two networks and three containers

front holds the web server and the proxy. back holds the database stand-in and the proxy. The proxy is the only container on both. An nginx container plays each role.

docker network create twonet-front | Out-Null
docker network create twonet-back | Out-Null
docker run -d --name twonet-web --network twonet-front nginx:1.30-alpine | Out-Null
docker run -d --name twonet-db --network twonet-back nginx:1.30-alpine | Out-Null
docker run -d --name twonet-proxy --network twonet-front nginx:1.30-alpine | Out-Null
docker network connect twonet-back twonet-proxy
docker inspect --format '{{range $name, $net := .NetworkSettings.Networks}}{{$name}} {{end}}' twonet-proxy

twonet-back twonet-front

The proxy started on one network, and docker network connect added the second one while it was running. You can also start a container on the first one with --network and attach more later. Connecting does not restart the container.

Check who can reach whom

Each container is asked to fetch a page from each of the others by name. A name only resolves on a network that both containers share.

foreach ($from in "twonet-web", "twonet-proxy") {
  foreach ($to in "twonet-web", "twonet-db") {
    docker exec $from wget -qO /dev/null -T 3 "http://$to" 2>$null
    "{0,-13} -> {1,-10} {2}" -f $from, $to, $(if ($LASTEXITCODE -eq 0) { "reached" } else { "no route" })
  }
}

twonet-web    -> twonet-web   reached
twonet-web    -> twonet-db    no route
twonet-proxy  -> twonet-web   reached
twonet-proxy  -> twonet-db    reached

The proxy reaches both, and the web server reaches only its own network. The web server cannot even resolve the database's name, because Docker's name lookup only covers networks a container is on. That is isolation you get for free, with no firewall rule.

The things that go wrong

• A name that works from one container and not another. Check whether they share a network. docker inspect on both lists their networks.
• The same alias on both networks. An alias is valid per network, so the proxy may need --network-alias on each of them.
• Order. docker run --network takes only one network. For two, run the container first and add the second with docker network connect. In a Compose file, list both under networks: for that service.

services:
  proxy:
    image: nginx:1.30-alpine
    networks: [front, back]
networks:
  front:
  back:

Clean up

docker rm -f twonet-web twonet-db twonet-proxy
docker network rm twonet-front twonet-back

Related course: Docker Intermediate.