Docker — network/inspect

About Docker networks: Docker networks enable container-to-container communication. Containers on the same user-defined network can reach each other by container name — DNS resolution is built in.

When to Use

Container membership audit: Check which containers are currently connected to a specific network — useful for debugging connectivity issues or verifying that a deployment wired containers to the correct network.
Subnet verification: Confirm the network's IPAM subnet and gateway configuration before connecting containers that have specific IP addressing requirements.
Dynamic ID retrieval: Look up the network ID by name so it can be passed programmatically to network/connect or network/disconnect without hardcoding IDs.
Networking compliance audit: Verify gateway configuration and driver options against the expected networking baseline for a given environment.

Configuration

Connection

Field	Type	Default	Description
`dockerHost`	string	`unix:///var/run/docker.sock`	Docker daemon socket path or TCP endpoint.
`connectionType`	string	`unixsocket`	One of: `unixsocket`, `tcp`, `tcptls`.
`tlsCertPath`	string	—	TLS certificate directory. Required for `tcptls`. optional
`timeoutSeconds`	int	30	Operation timeout. optional

Operation Fields

Field	Type	Badge	Description
`NetworkId`	string	required	Network ID (full or short) or network name.

Sample Configuration

{
  "resource": "network",
  "operation": "inspect",
  "connection": {
    "dockerHost": "unix:///var/run/docker.sock",
    "connectionType": "unixsocket"
  },
  "NetworkId": "app-backend"
}

Validation Errors

Error Code	Condition	Resolution
`MISSING_INPUT`	`NetworkId` field is empty.	Provide a network ID or name.
`NOT_FOUND`	Network does not exist.	Use `network/list` to confirm the network name or create it with `network/create`.
`CONFIG_ERROR`	Connection settings malformed.	Check `dockerHost` and `connectionType`.
`AUTH_FAILED`	TLS handshake failed.	Verify `tlsCertPath` certificates.

Output

Success Port

Field	Type	Description
`status`	string	`"ok"` on success.
`networkInfo.Id`	string	Full network ID.
`networkInfo.Name`	string	Network name.
`networkInfo.Driver`	string	Network driver.
`networkInfo.Scope`	string	`"local"` or `"swarm"`.
`networkInfo.IPAM`	object	IPAM configuration including `Subnet` and `Gateway`.
`networkInfo.Containers`	object	Map of container ID to container network endpoint info (name, IPv4 address).
`networkInfo.Options`	object	Driver-specific options.
`networkInfo.Labels`	object	Network labels.

Error Port

Fires when inspection fails. Output contains status: "error", errorCode, and errorMessage.

Sample Output

{
  "status": "ok",
  "resource": "network",
  "operation": "inspect",
  "networkInfo": {
    "Id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
    "Name": "app-backend",
    "Driver": "bridge",
    "Scope": "local",
    "IPAM": {
      "Config": [{ "Subnet": "172.20.0.0/16", "Gateway": "172.20.0.1" }]
    },
    "Containers": {
      "c3d4e5f6...": {
        "Name": "api-server",
        "IPv4Address": "172.20.0.3/16"
      },
      "d4e5f6a1...": {
        "Name": "db-postgres",
        "IPv4Address": "172.20.0.4/16"
      }
    },
    "Options": {},
    "Labels": { "env": "prod" }
  }
}

Expression Reference

Expression	Returns
`{{ $output.networkInfo.Id }}`	Full network ID — pass to `network/connect` or `network/disconnect`.
`{{ $output.networkInfo.IPAM.Config[0].Subnet }}`	Network subnet CIDR.
`{{ Object.keys($output.networkInfo.Containers).length }}`	Number of containers currently connected to this network.
`{{ Object.values($output.networkInfo.Containers).map(c => c.Name) }}`	Array of container names connected to this network.
`{{ $output.networkInfo.Driver }}`	Driver type — use in compliance assertion.

Node Policies & GuardRails

Policy	Enforcement
Never expose Docker daemon TCP without TLS	Use `tcptls` for remote connections. Plain `tcp` is blocked in production GuardRail profiles.
Store TLS certificates in Credentials Manager	Reference `tlsCertPath` via `{{ $credentials.dockerTlsCertPath }}`.
Never interpolate user input into NetworkId	Network references must come from trusted variables, not user-supplied input.
Disconnect containers before removing networks	Check `networkInfo.Containers` before calling `network/remove` — non-empty containers must be disconnected first.
Always handle the error port	Wire the `NOT_FOUND` error port to a `network/create` branch for idempotent setup workflows.
Restrict container/exec to approved commands	Arbitrary exec access is root-equivalent. GuardRail exec policies restrict allowed command prefixes.

Examples

Example 1 — Count Connected Containers

Inspect a network to verify the correct number of containers are connected after a deployment workflow completes.

// After network/inspect:
{{ Object.keys($output.networkInfo.Containers).length }}
// Assert equals expected container count

Example 2 — Pre-Remove Container Check

Before calling network/remove, inspect the network and verify no containers are connected. If any are, route to a disconnect loop first.

// After network/inspect:
{{ Object.keys($output.networkInfo.Containers).length === 0 }}
// true → proceed to network/remove
// false → loop through Containers and call network/disconnect for each

Example 3 — Retrieve Network ID by Name

Look up a network's full ID from its name to use with the Docker API directly via an HTTP Request node.

{
  "resource": "network",
  "operation": "inspect",
  "NetworkId": "app-backend"
}
// Then use: {{ $output.networkInfo.Id }}