Docker Volumes and Networking

Container data is temporarySearch on YouTubeBookmarkSaved

A container has its own writable layer on top of the read-only image layers. Files written inside the container live in that layer.

The lab shows this in four steps:

docker run -d --name demo nginx          # pulls nginx:latest if missing, then runs it
docker exec -it demo bash
echo "Hi, This is Jai, Testing the Container" > /tmp/test.txt
cat /tmp/test.txt                         # prints the line
exit

Stop and start: the file survives.

docker stop demo
docker start demo
docker exec -it demo bash
cat /tmp/test.txt                         # still there

Remove and recreate: the file is gone.

docker stop demo
docker rm demo
docker run -it --name demo1 nginx bash
cat /tmp/test.txt                         # No such file or directory

Real apps produce data that must outlive a container: database files, uploaded images, user documents, logs and other generated files. They need persistent storage outside the container's writable layer.

Docker volumesSearch on YouTubeBookmarkSaved

A volume is storage managed by Docker. Docker creates it, stores it under its own folder on the Docker host, and keeps it after containers are removed.

Create, list, inspectSearch on YouTubeBookmarkSaved

docker volume create vol_data
docker volume ls                 # DRIVER local, VOLUME NAME vol_data
docker volume inspect vol_data

inspect shows JSON with CreatedAt, Driver: "local", Labels, Mountpoint: "/var/lib/docker/volumes/vol_data/_data", Name, Options and Scope: "local". The mountpoint is where the data sits on the Docker host.

Mount a volume into a containerSearch on YouTubeBookmarkSaved

Long form with --mount:

docker run -it --name cont_vol --mount type=volume,source=vol_data,target=/mydata nginx bash

Short form with -v volume:path:

docker run -it --name cont_vol2 -v vol_data:/mydata nginx bash

In PowerShell the same command can be split over lines with a backtick:

docker run -it `
  --name cont_vol2 `
  -v vol_data:/mydata `
  nginx bash

Inside the container, ls / now shows a mydata folder.

If the volume does not exist, Docker creates it while running the container:

docker run -it --name cont_vol3 -v vol_data1:/mydata1 nginx bash
docker volume ls     # vol_data and vol_data1

Data survives container removalSearch on YouTubeBookmarkSaved

# inside cont_vol
echo "This text is from Volume" > /mydata/test.txt
exit

docker rm cont_vol
docker run -it --name cont_vol1 --mount type=volume,source=vol_data,target=/mydata nginx bash
cat /mydata/test.txt     # This text is from Volume

Many containers, one volumeSearch on YouTubeBookmarkSaved

Start cont_vol1 and cont_vol2, both mounting vol_data. A file written from one is visible in the other at once:

docker start cont_vol1
docker exec -it cont_vol1 bash
cd mydata && echo "This is written from cont_vol1" > test1.txt

docker start cont_vol2
docker exec -it cont_vol2 bash
cat /mydata/test1.txt    # This is written from cont_vol1

Key pointsSearch on YouTubeBookmarkSaved

• Containers are disposable: container gone, data also gone.
• A volume is persistent; the container is disposable.
• A Docker volume consumes storage on the Docker host.
• Every container on the same Docker host can access the same volume at the same time.
• Volume is not synchronisation across machines. Developer 1 and Developer 2 on different machines do not share a volume.

Bind mountsSearch on YouTubeBookmarkSaved

A bind mount maps an exact host folder into the container. You choose the path; Docker does not create or manage the storage.

The lab runs two nginx containers that serve the same host folder (holding an index.html with "Hello from Bind Mount!"):

docker run -d --name cont_bind1 -p 8001:80 --mount "type=bind,src=.,target=/usr/share/nginx/html" nginx

docker run -d `
  --name cont_bind2 `
  -p 8002:80 `
  -v ${PWD}:/usr/share/nginx/html `
  nginx

${PWD} is the current folder in PowerShell (use $(pwd) in a Linux shell). Both localhost:8001 and localhost:8002 show the page.

Edit index.html on the host. Both containers show the new content at once, with no rebuild. This is why bind mounts suit development: you edit source code on the host and the container sees it live.

Volume vs bind mountSearch on YouTubeBookmarkSaved

Container networkingSearch on YouTubeBookmarkSaved

Default network typesSearch on YouTubeBookmarkSaved

docker network ls

Docker creates these three networks on install.

1. Default bridgeSearch on YouTubeBookmarkSaved

Containers join the default bridge network unless told otherwise.

docker create --name cont1 --network bridge busybox
docker create --name cont2 --network bridge busybox
docker create --name cont3 --network bridge nginx
docker exec -itd cont1 sh

The Docker engine creates a virtual switch, docker0, with gateway 172.17.0.1 on subnet 172.17.0.0/16. Each container gets a virtual Ethernet (veth) interface and an IP: cont1 172.17.0.2, cont2 172.17.0.3, cont3 172.17.0.4. Traffic to the internet leaves through the host's interface using NAT.

docker inspect network bridge

The output shows Driver: "bridge", EnableIPv4: true, EnableIPv6: false, and under IPAM.Config the Subnet: "172.17.0.0/16" and Gateway: "172.17.0.1". The Containers section lists each container's name, MAC address and IPv4Address.

Inside cont1 (ip a shows eth0 with 172.17.0.2/16):

ping 172.17.0.3      # works
ping 172.17.0.4      # works
ping google.com      # works: the bridge reaches the internet
ping cont2           # ping: bad address 'cont2'

2. User-defined bridgeSearch on YouTubeBookmarkSaved

# creating a user defined network (default driver is bridge)
docker network create --driver bridge mynetwork
docker run -itd --name cont1 --network mynetwork busybox

docker network ls now lists mynetwork with driver bridge. docker inspect network mynetwork shows a new subnet 172.18.0.0/16 with gateway 172.18.0.1.

Connect the existing containers and start them:

docker network connect mynetwork cont1
docker network connect mynetwork cont2
docker network connect mynetwork cont3
docker start cont1 cont2 cont3

They get 172.18.0.2, 172.18.0.3 and 172.18.0.4. Now DNS works:

ping cont2     # PING cont2 (172.18.0.3)
ping cont3     # PING cont3 (172.18.0.4)

Multiple interfacesSearch on YouTubeBookmarkSaved

• Stopping and starting a container does not disconnect it from the default bridge it joined before.
• docker network connect mynetwork cont1 adds another network interface for mynetwork.
• A container can have several network interfaces, so it can be on several Docker networks at once.

ip a inside cont1 shows eth0@if20 with 172.17.0.2/16 (default bridge) and eth1@if21 with 172.18.0.2/16 (mynetwork).

docker network disconnect bridge cont1
docker network disconnect bridge cont2
docker network disconnect bridge cont3

After this, ip a in cont1 shows only eth1 (172.18.0.2/16). cont1 is connected only to mynetwork.

Bridge isolationSearch on YouTubeBookmarkSaved

The default bridge network and a user-defined bridge network are isolated from each other. Containers on one cannot reach containers on the other.

3. Host networkSearch on YouTubeBookmarkSaved

docker run -itd --network host --name cont4 nginx
docker exec cont4 sh
docker exec -it cont4 sh

The container shares the host's network namespace directly. It gets no private container IP and sees all the host's interfaces (for example eth0, docker0). The host can reach this container. This is easier to see on native Linux than on Docker Desktop, where "host" means the WSL 2 VM.

4. MacvlanSearch on YouTubeBookmarkSaved

Each container gets its own MAC address and IP on the physical LAN. It is like plugging the container straight into the router.

sudo docker network create -d macvlan \
  --subnet <your VM subnet/n> \
  --gateway <your VM gateway> \
  -o parent=<VM NIC interface> \
  mymacvlan

sudo docker run -itd --network mymacvlan --ip <assign new ip> --name cont1 busybox

The host NIC must have promiscuous mode enabled (on the Ubuntu VM and its adapter) so it accepts frames for the extra MACs.

5. IPvlanSearch on YouTubeBookmarkSaved

Containers share the parent interface's MAC address but get their own IPs. No promiscuous mode is needed. The deck shows the containers and the host machine can now interact.

sudo docker network create -d ipvlan \
  --subnet <subnet> \
  --gateway <gateway> \
  -o parent=<link to VM eth interface> \
  my_ipvlan

6. OverlaySearch on YouTubeBookmarkSaved

Overlay networks are for a Swarm of Docker containers spread across several hosts. The lab does not use them.

7. NoneSearch on YouTubeBookmarkSaved

A completely isolated container. No IP is assigned and it has no network interface except loopback. Best for sandboxing.

Quick self-testSearch on YouTubeBookmarkSaved