1# Network Isolation
2
3Installation network policy for Gordon-managed networks.
4
5## Configuration
6
7```toml
8[network_isolation]
9enabled = true
10network_prefix = "gordon"
11internal = false
12```
13
14## Options
15
16| Option | Type | Default | Description |
17|--------|------|---------|-------------|
18| `enabled` | bool | `true` | Enable Gordon-managed network policy |
19| `network_prefix` | string | `"gordon"` | Prefix filter for `gordon daemon networks` |
20| `internal` | bool | `false` | Create isolated Docker networks with Docker's `Internal` flag, blocking direct external egress from containers on those networks. |
21
22Per-app isolation is declared in app files, not here: each app gets a private network automatically, and services can join named shared networks with `[[network.shared]]` (see [App Manifest](./apps.md)). Deploy adds AND removes memberships without disconnecting unrelated services. Shared networks are created/reused only within verified Gordon ownership.
23
24## Service-to-Service Networking
25
26Every app container joins an incarnation-owned private network. Services of the same app communicate over that network and can resolve each other by service alias.
27
28Different apps are isolated by default: a container on one app network cannot reach another app's network. Cross-app communication happens only when both services declare the same `[[network.shared]]` membership, which attaches the explicitly enrolled containers to a shared network.
29
30Readiness helpers never join shared networks and exist only on the target app's private network.
31
32## Inspecting Networks
33
34View Gordon-managed networks:
35
36```bash
37gordon daemon networks
38docker network ls | grep gordon
39```
40
41Inspect a network:
42
43```bash
44docker network inspect <network-name>
45```
46
47## Related
48
49- [App Manifest](./apps.md)
50- [Configuration Overview](./index.md)