LEARN. PRACTICE. GROW.Concept and mechanism
A container network has its own context. On a user-defined bridge, names and aliases enable discovery among attached containers; the default bridge does not provide the same automatic convenience. A DNS override to 127.0.0.1 targets container loopback when it has its own namespace. It does not automatically reach the host resolver. Port publishing also requires attention to address and network mode. On Engine 28 or later, ordinary loopback publication limits that access to the host; earlier versions have a same-L2 access caveat. Additional forwarding rules and routed modes require their own assessment.
Guided application
In a fictional incident, compare load-balancer configuration with Swarm publishing mode. Ingress uses the routing mesh and can accept traffic on a node without a local task; host mode requires a target with a valid service listener. If tasks move, discovery and health checks need to follow placement. An SSH check proves host access rather than application health. For traffic between Linux nodes, encrypted Swarm management does not itself enable overlay data encryption. That option requires explicit configuration and impact measurement. Draw DNS, request, management, and observability paths separately. This separation helps assign symptoms to the right layer and avoids broad firewall changes without a testable hypothesis.
Failures only on targets without tasks after moving to host mode: review balancer discovery.
Common pitfalls
Loopback as remote host; SSH as service health; ingress as host; encrypted management as all encrypted data.
Related topics: Swarm: desired state, placement, and quorum · Delivery, rollback, and readiness · Reproducible images and registries
Confirm namespace, destination, listener, and protection of each path.
Reference: Container networking · DCA Study Guide v1.5 (January2025); current exam listing checked2026-09-30