Docker — network/disconnect

Live traffic impact: Disconnecting a container from a network immediately removes its reachability on that network. Any in-flight requests to the container from other containers on that network will fail. Coordinate with load balancer draining before disconnecting production containers.

When to Use

Blue-green cut-over: After connecting the new (green) container to the load-balancer network, disconnect the old (blue) container to stop traffic from reaching it without stopping the container itself.
Security incident response: Immediately disconnect a container suspected of compromise from all application networks to contain lateral movement, while keeping it running for forensic investigation.
Maintenance reconfiguration: Remove a container from a specific network segment during a maintenance window to reconfigure its network membership without downtime.

Configuration

Connection

Field	Type	Default	Description
`dockerHost`	string	`unix:///var/run/docker.sock`	Docker daemon socket path or TCP endpoint.
`connectionType`	string	`unixsocket`	One of: `unixsocket`, `tcp`, `tcptls`.
`tlsCertPath`	string	—	TLS certificate directory. Required for `tcptls`. optional
`timeoutSeconds`	int	30	Operation timeout. optional

Operation Fields

Field	Type	Badge	Description
`NetworkId`	string	required	Network ID or name to disconnect the container from.
`ContainerId`	string	required	Container ID or name to disconnect.

Sample Configuration

{
  "resource": "network",
  "operation": "disconnect",
  "connection": {
    "dockerHost": "unix:///var/run/docker.sock",
    "connectionType": "unixsocket"
  },
  "NetworkId": "app-backend",
  "ContainerId": "api-server-blue"
}

Validation Errors

Error Code	Condition	Resolution
`MISSING_INPUT`	`NetworkId` or `ContainerId` is empty.	Provide both network and container references.
`NOT_FOUND`	Network or container does not exist, or the container is not connected to the network.	Treat as idempotent in cleanup workflows — the container is already disconnected.
`CONFIG_ERROR`	Connection settings malformed.	Check `dockerHost` and `connectionType`.
`DOCKER_API_ERROR`	Cannot disconnect from the default network or last network.	A container must remain on at least one network unless it uses `--network none`.

Output

Success Port

Field	Type	Description
`status`	string	`"ok"` when disconnected successfully.
`resource`	string	`"network"`
`operation`	string	`"disconnect"`
`networkId`	string	The network the container was disconnected from.
`containerId`	string	The container that was disconnected.

Error Port

Fires when disconnection fails. Output contains status: "error", errorCode, and errorMessage.

Sample Output

{
  "status": "ok",
  "resource": "network",
  "operation": "disconnect",
  "networkId": "app-backend",
  "containerId": "api-server-blue"
}

Expression Reference

Expression	Returns
`{{ $output.status }}`	`"ok"` — gate network removal on this value.
`{{ $output.containerId }}`	Container disconnected — include in deployment audit trail.
`{{ $output.networkId }}`	Network disconnected from — use to confirm before `network/remove`.

Node Policies & GuardRails

Policy	Enforcement
Never expose Docker daemon TCP without TLS	Use `tcptls` for remote connections. Plain `tcp` is blocked in production GuardRail profiles.
Store TLS certificates in Credentials Manager	Reference `tlsCertPath` via `{{ $credentials.dockerTlsCertPath }}`.
Drain load balancer before disconnecting production containers	Disconnecting without draining drops in-flight requests. Add a load-balancer drain step before calling `network/disconnect` in production deployments.
Never interpolate user input into NetworkId or ContainerId	Network and container references must come from trusted workflow variables.
Disconnect containers before removing networks	`network/remove` returns `CONFLICT` if containers are still connected. Always disconnect first.
Restrict container/exec to approved commands	Arbitrary exec access is root-equivalent. GuardRail exec policies restrict allowed command prefixes.

Examples

Example 1 — Blue-Green Traffic Cut-Over

After connecting the new green container to the load-balancer network, disconnect the old blue container to stop traffic without stopping it.

// Step 1: Connect green (already done in previous node)
// Step 2: Disconnect blue
{
  "resource": "network",
  "operation": "disconnect",
  "NetworkId": "lb-network",
  "ContainerId": "api-server-blue"
}
// Step 3: container/stop then container/remove for blue

Example 2 — Security Incident: Network Isolation

On detection of suspicious behavior, disconnect a container from all networks to prevent lateral movement while preserving its state for forensic analysis.

// Step 1: network/inspect on each network to get connected containers
// Step 2: For each network the compromised container is on, disconnect:
{
  "resource": "network",
  "operation": "disconnect",
  "NetworkId": "{{ $loopItem.networkId }}",
  "ContainerId": "{{ $trigger.suspiciousContainerId }}"
}
// Container remains running but network-isolated

Example 3 — Pre-Remove Network Cleanup

Before calling network/remove, disconnect all containers from the network. Loop through the Containers object from network/inspect.

// Loop over Object.keys($node['network-inspect'].output.networkInfo.Containers):
{
  "resource": "network",
  "operation": "disconnect",
  "NetworkId": "ci-run-{{ $trigger.runId }}",
  "ContainerId": "{{ $loopItem }}"
}
// After loop completes: network/remove