Study Hub / Docker Certified Associate (DCA) / Domain 4.0
Docker Certified Associate (DCA) Domain 4.0: Networking — Explained
Domain 4.0 is how containers talk: the network drivers Docker provides, when each fits, and how traffic gets from the outside world to a container — and between containers across hosts.
Network drivers: the menu
- bridge (default) — containers on one host get private IPs on a virtual bridge; they reach each other by name (on user-defined bridges) and the outside via NAT. The single-host default.
- host — the container shares the host's network stack directly: no isolation, no port mapping needed, maximum performance. Also maximum exposure — use sparingly.
- none — no networking at all. For containers that truly need none (compute-only batch jobs) or get networking some custom way.
- overlay — multi-host networking for Swarm: containers on different hosts join one virtual network with built-in encryption options. The "containers across machines act like one LAN" driver.
- macvlan — gives containers real MAC addresses on the physical network, as if they were physical devices. For apps that need to look like hardware (legacy monitoring, DHCP-dependent apps).
Publishing ports and DNS
- EXPOSE vs. -p — EXPOSE documents ports in the image;
-p host:containeractually publishes them to the host. Documentation doesn't open ports. - Port conflicts — two containers can't publish the same host port. User-defined bridge networks avoid most of this: containers talk to each other by name on internal ports, and only the front door needs a published port.
- Embedded DNS — user-defined bridge networks get a built-in DNS server: containers resolve each other by name automatically. (The default bridge lacks this — another reason to create your own networks.)
- Ingress in Swarm — the routing mesh publishes a service port on every swarm node; internal load balancing spreads it to the actual containers wherever they run.
Designing container networks
- One network per concern — frontend network (web ↔ app), backend network (app ↔ database). The database container simply isn't on the frontend network — segmentation by topology.
- Don't expose the database — app containers reach the DB by name on the internal network; only the web tier publishes ports to the host. Every published port is attack surface.
- Overlay encryption — control-plane traffic is encrypted by default in Swarm; data-plane encryption is opt-in per network. Know it exists and that it costs some performance.
- Troubleshooting order — can the containers resolve each other (DNS)? Are they on the same network? Is the port published (and not conflicting)? Is a firewall eating it? Name → network → publish → firewall.
The must-memorize table: Docker network drivers
Which driver for which topology.
| Driver | Scope | Use it when |
|---|---|---|
| bridge | Single host | Default; containers on one machine |
| host | Single host (no isolation) | Max performance; no network isolation needed |
| none | No network | Isolated compute; custom networking |
| overlay | Multi-host (Swarm) | Containers across hosts, one virtual network |
| macvlan | Physical network | Containers need real MACs / look like hardware |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. Two containers on the same host need to communicate by name, isolated from other projects' containers. What should the admin create?
- A. A. Nothing — the default bridge provides DNS by name
- B. B. A user-defined bridge network for the project
- C. C. A host network for maximum speed
- D. D. An overlay network
Show answer & reasoning
B. User-defined bridges provide automatic DNS resolution by container name and isolation from other networks — the default bridge has neither (no embedded DNS, all containers lumped together). Host (C) destroys isolation; overlay (D) is for multi-host.
2. A web container must be reachable from outside the host on port 8080, mapping to its internal port 80. Which flag does this?
- A. A. --expose 8080
- B. B. -p 8080:80 — publish host port 8080 to container port 80
- C. C. --network host
- D. D. -e PORT=8080
Show answer & reasoning
B. -p host:container publishes: traffic to the host's 8080 reaches the container's 80. EXPOSE (A) only documents; host networking (C) shares the whole stack (overkill and exposed); -e (D) sets an env var the app may ignore. Format is always host:container, left to right.
3. A Swarm service must be reachable on port 80 from any swarm node, with traffic load-balanced to its containers wherever they run. What provides this?
- A. A. A bridge network on each node
- B. B. The Swarm routing mesh (ingress) — publishes the port on every node with internal load balancing
- C. C. host networking on every container
- D. D. macvlan on each node
Show answer & reasoning
B. The routing mesh is Swarm's ingress: every node listens on the published port and the mesh routes to healthy task containers cluster-wide. Per-node bridges (A) don't span hosts; host networking (C) can't load-balance across nodes. "Any node, balanced to containers" → routing mesh.
4. A legacy monitoring tool requires each monitored container to have its own MAC address visible on the physical LAN. Which driver fits?
- A. A. bridge
- B. B. overlay
- C. C. macvlan — containers appear as physical devices with real MACs
- D. D. none
Show answer & reasoning
C. macvlan assigns containers MAC addresses on the physical network — they look like real hardware to switches, DHCP, and monitoring tools. Bridge (A) and overlay (B) hide containers behind NAT/virtual networks; none (D) gives no network at all. "Look like hardware" → macvlan.
This was one domain. The simulator drills all 6.
This free preview covered Networking (Domain 4.0, 15%). Not covered here: Orchestration (Domain 1.0, 25%); Security (Domain 5.0, 15%). Swarm orchestration and Docker security — the most scenario-heavy DCA material — stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full DCA Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy