1# Network Isolation
2
3Isolate applications in separate Docker networks for enhanced security.
4
5## Configuration
6
7```toml
8[network_isolation]
9enabled = true
10network_prefix = "gordon"
11```
12
13## Options
14
15| Option | Type | Default | Description |
16|--------|------|---------|-------------|
17| `enabled` | bool | `false` | Enable per-app network isolation |
18| `network_prefix` | string | `"gordon"` | Prefix for created networks |
19
20## How It Works
21
22When network isolation is enabled, each application gets its own Docker network:
23
24```
25[network_isolation]
26enabled = true
27network_prefix = "gordon"
28
29[routes]
30"app.mydomain.com" = "myapp:latest"
31"api.mydomain.com" = "myapi:latest"
32```
33
34Creates two isolated networks:
35- `gordon-app-mydomain-com`
36- `gordon-api-mydomain-com`
37
38## Network Naming
39
40Networks are named: `{prefix}-{domain-with-dashes}`
41
42| Domain | Network Name |
43|--------|--------------|
44| `app.mydomain.com` | `gordon-app-mydomain-com` |
45| `api.company.io` | `gordon-api-company-io` |
46| `staging.app.dev` | `gordon-staging-app-dev` |
47
48## Security Benefits
49
50### Without Network Isolation
51
52All containers can potentially communicate:
53
54```
55┌───────────────────────────────────────┐
56│ Default Bridge Network                │
57│                                       │
58│  App A ←──────→ App B ←──────→ App C  │
59│    ↕              ↕              ↕    │
60│  DB A ←──────→ DB B  ←──────→  DB C   │
61│                                       │
62└───────────────────────────────────────┘
63```
64
65### With Network Isolation
66
67Each app is isolated with its dependencies:
68
69```
70┌─────────────────┐  ┌─────────────────┐  ┌─────────────────┐
71│ gordon-app-a    │  │ gordon-app-b    │  │ gordon-app-c    │
72│                 │  │                 │  │                 │
73│  App A ←→ DB A  │  │  App B ←→ DB B  │  │  App C ←→ DB C  │
74│                 │  │                 │  │                 │
75└─────────────────┘  └─────────────────┘  └─────────────────┘
76        ↑                   ↑                   ↑
77        └───────── No direct communication ─────┘
78```
79
80## Service Discovery
81
82Within an isolated network, services are discoverable by name:
83
84```toml
85[network_isolation]
86enabled = true
87
88[attachments]
89"app.mydomain.com" = ["postgres:latest", "redis:latest"]
90```
91
92Your application connects using simple hostnames:
93
94```python
95# These work within the isolated network
96db = connect("postgresql://postgres:5432/mydb")
97cache = connect("redis://redis:6379")
98```
99
100## Examples
101
102### Basic Isolation
103
104```toml
105[network_isolation]
106enabled = true
107
108[routes]
109"app.mydomain.com" = "myapp:latest"
110"api.mydomain.com" = "myapi:latest"
111
112[attachments]
113"app.mydomain.com" = ["app-postgres:latest"]
114"api.mydomain.com" = ["api-postgres:latest"]
115```
116
117Each app gets its own network with its own database.
118
119### Production Configuration
120
121```toml
122[network_isolation]
123enabled = true
124network_prefix = "prod"
125
126[routes]
127"app.company.com" = "company-app:v2.1.0"
128"api.company.com" = "company-api:v1.5.0"
129"admin.company.com" = "admin-panel:v1.0.0"
130```
131
132Creates networks:
133- `prod-app-company-com`
134- `prod-api-company-com`
135- `prod-admin-company-com`
136
137### Shared Services with Network Groups
138
139When apps need to communicate, use network groups:
140
141```toml
142[network_isolation]
143enabled = true
144
145[network_groups]
146"backend" = ["app.mydomain.com", "api.mydomain.com"]
147
148[attachments]
149"backend" = ["shared-postgres:latest", "shared-redis:latest"]
150```
151
152Both apps share the `gordon-backend` network.
153
154## Inspecting Networks
155
156View created networks:
157
158```bash
159docker network ls | grep gordon
160# gordon-app-mydomain-com
161# gordon-api-mydomain-com
162# gordon-backend
163```
164
165Inspect a network:
166
167```bash
168docker network inspect gordon-app-mydomain-com
169```
170
171## Related
172
173- [Network Groups](./network-groups.md)
174- [Attachments](./attachments.md)
175- [Configuration Overview](./index.md)