Docker — network/list

About Docker networks: Docker networks enable container-to-container communication. Containers on the same user-defined network can reach each other by container name — DNS resolution is built in. The default bridge network does not provide automatic DNS between containers.

When to Use

Unused network audit: List all networks and cross-reference with running containers to identify isolated networks with no attached containers that can be safely removed.
Pre-deploy verification: Confirm that the expected application network exists before deploying containers that need to communicate over it.
Network ID lookup: Retrieve a network's ID by name for downstream network/connect or network/inspect calls.
Swarm overlay monitoring: List overlay networks to verify the state of Swarm mode service networking.
Compliance check: Verify that no host-mode networks are in use in a production environment where process isolation is required.

Configuration

Connection

Field	Type	Default	Description
`dockerHost`	string	`unix:///var/run/docker.sock`	Docker daemon socket path or TCP endpoint.
`connectionType`	string	`unixsocket`	One of: `unixsocket`, `tcp`, `tcptls`.
`tlsCertPath`	string	—	TLS certificate directory. Required for `tcptls`. optional
`timeoutSeconds`	int	30	Operation timeout. optional

Operation Fields

This operation requires no additional input fields. Set resource to network and operation to list.

Sample Configuration

{
  "resource": "network",
  "operation": "list",
  "connection": {
    "dockerHost": "unix:///var/run/docker.sock",
    "connectionType": "unixsocket"
  }
}

Validation Errors

Error Code	Condition	Resolution
`CONFIG_ERROR`	Connection settings missing or malformed.	Check `dockerHost` and `connectionType`.
`AUTH_FAILED`	TLS handshake failed.	Verify `tlsCertPath` certificates.
`DOCKER_API_ERROR`	Unexpected daemon error.	Check Docker daemon logs.

Output

Success Port

Field	Type	Description
`status`	string	`"ok"` on success.
`resource`	string	`"network"`
`operation`	string	`"list"`
`listNetworks`	array	Array of network summary objects.
`listNetworks[].Id`	string	Full network ID (hex string).
`listNetworks[].Name`	string	Network name.
`listNetworks[].Driver`	string	Network driver: `bridge`, `overlay`, `host`, `none`.
`listNetworks[].Scope`	string	`"local"` or `"swarm"`.
`listNetworks[].IPAM`	object	IP address management config with `Subnet` and `Gateway`.
`listNetworks[].Options`	object	Driver-specific options.

Error Port

Fires when the operation fails. Output contains status: "error", errorCode, and errorMessage.

Sample Output

{
  "status": "ok",
  "resource": "network",
  "operation": "list",
  "listNetworks": [
    {
      "Id": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
      "Name": "app-backend",
      "Driver": "bridge",
      "Scope": "local",
      "IPAM": {
        "Config": [{ "Subnet": "172.20.0.0/16", "Gateway": "172.20.0.1" }]
      },
      "Options": {}
    },
    {
      "Id": "b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3",
      "Name": "bridge",
      "Driver": "bridge",
      "Scope": "local",
      "IPAM": {
        "Config": [{ "Subnet": "172.17.0.0/16", "Gateway": "172.17.0.1" }]
      },
      "Options": {}
    }
  ]
}

Expression Reference

Expression	Returns
`{{ $output.listNetworks[0].Id }}`	ID of the first network — pass to `network/connect`.
`{{ $output.listNetworks[0].Name }}`	Name of the first network.
`{{ $output.listNetworks.length }}`	Total number of networks on the host.
`{{ $output.listNetworks[0].Driver }}`	Driver type — use to filter for `host`-mode compliance check.
`{{ $output.listNetworks[0].IPAM.Config[0].Subnet }}`	Network subnet CIDR.

Node Policies & GuardRails

Policy	Enforcement
Never expose Docker daemon TCP without TLS	Use `tcptls` for remote connections. Plain `tcp` is blocked in production GuardRail profiles.
Store TLS certificates in Credentials Manager	Reference `tlsCertPath` via `{{ $credentials.dockerTlsCertPath }}`.
Disconnect containers before removing networks	Calling `network/remove` on a network with attached containers returns `CONFLICT`. Disconnect first.
Never use host-mode networks in production	Host-mode removes network namespace isolation. GuardRail compliance checks flag `Driver: "host"` networks.
Always handle the error port	Daemon unavailability will route to the error port — wire it to alerting nodes.
Restrict container/exec to approved commands	Arbitrary exec access is root-equivalent. GuardRail exec policies restrict allowed command prefixes.

Examples

Example 1 — Verify Network Exists Before Deploy

List all networks and confirm the application network is present before proceeding to container creation. Route to network/create if absent.

// After network/list:
{{ $output.listNetworks.some(n => n.Name === 'app-backend') }}
// true → proceed to container/create
// false → network/create first

Example 2 — Retrieve Network ID for Connection

Find a network by name and extract its ID for downstream network/connect or network/inspect calls.

// Find network by name:
{{ $output.listNetworks.find(n => n.Name === 'app-backend')?.Id }}

Example 3 — Compliance Check: No Host-Mode Networks

Assert that no network on the host uses the host driver — fail the workflow if any are found.

// Condition: should be false for compliant environments
{{ $output.listNetworks.some(n => n.Driver === 'host') }}
// If true → send compliance alert and abort workflow