None Network

So far, every Docker networking mode we’ve used has been about connecting a container to something.

The none network is the opposite.

It gives the container no network connectivity at all.

That sounds almost too simple to deserve a lesson, but sometimes “this container must not communicate over the network” is exactly the requirement you want.

What Is none Networking?

Run a container with:

docker container run -d \
  --name offline \
  --network none \
  alpine:latest \
  sleep 300

The container is running, but Docker has deliberately not connected it to a network.

The mental model is:

        Docker Host
┌───────────────────────────┐
│                           │
│   ┌───────────────────┐   │
│   │     Container     │   │
│   │                   │   │
│   │   No network      │   │
│   │   connectivity    │   │
│   └───────────────────┘   │
│                           │
└───────────────────────────┘

Compare that with the other two modes:

bridge
Container → bridge → host/network

host
Container → host network

none
Container → nothing

That is the entire idea.

What Does “No Network” Actually Mean?

A container using none gets only the loopback interface:

lo

You can see the interfaces with:

docker container exec offline ip addr

The important point is that there is no normal Docker network interface such as eth0.

The container can still use:

localhost

for communication with itself.

But it cannot use Docker’s normal networking to reach:

• the host
• other containers
• the Internet

So:

localhost
   ↓
container itself

other container
    ↓
    ✗

Internet
   ↓
   ✗

A Quick Test

Try reaching an external site:

docker container exec offline wget -qO- https://example.com

It should fail because the container has no network path.

You can also inspect the container:

docker container inspect offline

The network mode will show:

none

Why Would You Want This?

At first, none may seem useless.

But “no network access” can be a useful security and isolation property.

For example, imagine a container that performs a batch operation on data already available inside the container.

It doesn’t need to:

download anything
send anything
talk to another service

Giving it network access would provide capability it doesn’t need.

A none network lets you express that requirement directly:

This workload does not need networking.

This can be useful for things such as:

• offline processing
• isolated batch jobs
• certain security-sensitive workloads
• testing software that should not make network requests

The exact security properties still depend on the rest of the container configuration, so none should not be treated as a complete security boundary by itself.

none vs Host

These two are almost opposites:

host
  ↓
Share the host's network namespace

none
  ↓
Don't provide a network connection

A simple comparison:

none Doesn’t Mean the Container Can’t Run

This is worth remembering.

A container can be perfectly functional without networking.

For example:

docker container run --rm \
  --network none \
  alpine:latest \
  sh -c 'echo "I can run without a network"'

The container starts, runs its command, prints the message, and exits.

Networking simply isn’t part of the workload.

This is a useful way to think about it:

Container
├── CPU
├── Memory
├── Filesystem
├── Processes
└── Network
      └── none

Removing networking doesn’t remove the container itself.

The Mental Model to Remember

Keep this picture:

              Container
        ┌──────────────────┐
        │                  │
        │       lo         │
        │       ↑          │
        │    localhost     │
        │                  │
        │   no eth0        │
        │   no bridge      │
        │   no Internet    │
        │                  │
        └──────────────────┘

The one sentence to remember is:

none gives the container no normal network connectivity.

Clean Up

Remove the test container:

docker container rm -f offline

That’s all there is to it.

The Three Single-Host Network Modes

You’ve now seen the three modes worth remembering for ordinary single-host Docker work:

bridge
   ↓
Normal isolated container networking

host
   ↓
Share the host's network namespace

none
   ↓
No normal network connectivity

Or, even shorter:

bridge → connect
host   → share
none   → isolate

What’s Next

With the networking drivers covered, we’ll next cover full lifecycle of Docker Networking — creating, connecting, inspecting, removing networks and nuances. This is more than commands to remember, it’s more about how you approach your docker network in real cases.