Docker — network/remove

Prerequisite: Removing a network with connected containers returns CONFLICT. Always call network/disconnect for each connected container before calling network/remove. Use network/inspect to enumerate connected containers.

When to Use

CI teardown: Remove the ephemeral test network created for a CI run after all test containers have been stopped and removed.
Tenant offboarding: Remove the tenant's dedicated network as the final step of the offboarding workflow after all tenant containers and volumes are decommissioned.
Deprecated network cleanup: Remove old network configurations after a service topology migration to the new network layout.

Configuration

Connection

Field	Type	Default	Description
`dockerHost`	string	`unix:///var/run/docker.sock`	Docker daemon socket path or TCP endpoint.
`connectionType`	string	`unixsocket`	One of: `unixsocket`, `tcp`, `tcptls`.
`tlsCertPath`	string	—	TLS certificate directory. Required for `tcptls`. optional
`timeoutSeconds`	int	30	Operation timeout. optional

Operation Fields

Field	Type	Badge	Description
`NetworkId`	string	required	Network ID or name to remove.

Sample Configuration

{
  "resource": "network",
  "operation": "remove",
  "connection": {
    "dockerHost": "unix:///var/run/docker.sock",
    "connectionType": "unixsocket"
  },
  "NetworkId": "ci-run-abc123"
}

Validation Errors

Error Code	Condition	Resolution
`MISSING_INPUT`	`NetworkId` field is empty.	Provide the network ID or name to remove.
`NOT_FOUND`	Network does not exist (already removed or never created).	Treat as success in cleanup workflows — the network is already absent.
`CONFLICT`	Network has one or more containers still connected.	Call `network/disconnect` for each container listed in `network/inspect` first.
`CONFIG_ERROR`	Connection settings malformed.	Check `dockerHost` and `connectionType`.
`DOCKER_API_ERROR`	Attempt to remove a built-in network (`bridge`, `host`, `none`).	Built-in networks cannot be removed. Only remove user-created networks.

Output

Success Port

Field	Type	Description
`status`	string	`"ok"` when the network is removed.
`resource`	string	`"network"`
`operation`	string	`"remove"`
`networkId`	string	The network ID or name that was removed.

Error Port

Fires when removal fails. The most common code is CONFLICT — containers are still connected.

Sample Output

{
  "status": "ok",
  "resource": "network",
  "operation": "remove",
  "networkId": "ci-run-abc123"
}

Expression Reference

Expression	Returns
`{{ $output.status }}`	`"ok"` — confirm removal before writing to audit log.
`{{ $output.networkId }}`	The removed network — include in offboarding audit record.
`{{ $output.errorCode }}`	`"CONFLICT"` — containers still connected; `"NOT_FOUND"` — already removed.

Node Policies & GuardRails

Policy	Enforcement
Never expose Docker daemon TCP without TLS	Use `tcptls` for remote connections. Plain `tcp` is blocked in production GuardRail profiles.
Store TLS certificates in Credentials Manager	Reference `tlsCertPath` via `{{ $credentials.dockerTlsCertPath }}`.
Disconnect all containers before removing networks	Always call `network/disconnect` for each connected container. `network/inspect` provides the container list.
Never remove built-in networks	The `bridge`, `host`, and `none` networks cannot be removed. Only remove user-created networks.
Always handle the error port	Wire the `CONFLICT` error port to a disconnect-and-retry branch.
Restrict container/exec to approved commands	Arbitrary exec access is root-equivalent. GuardRail exec policies restrict allowed command prefixes.

Examples

Example 1 — CI Network Teardown

After all CI containers complete, disconnect them from the test network, then remove it.

// Step 1 — network/inspect to get connected containers
// Step 2 — loop: network/disconnect for each container
// Step 3 — network/remove
{
  "resource": "network",
  "operation": "remove",
  "NetworkId": "ci-run-{{ $trigger.runId }}"
}

Example 2 — Tenant Offboarding Final Step

Remove the tenant network after containers are stopped/removed, volumes are backed up and removed, and the tenant record is marked inactive.

{
  "resource": "network",
  "operation": "remove",
  "NetworkId": "tenant-{{ $trigger.tenantId }}"
}
// On success: update tenant record status to "decommissioned"
// On NOT_FOUND: already removed — treat as success

Example 3 — Safe Idempotent Cleanup

Handle both NOT_FOUND (already removed) and success as acceptable outcomes in a cleanup workflow.

// network/remove node → success port AND error port (NOT_FOUND) both merge into:
// "Log: network {{ networkId }} is absent"
// Only escalate on CONFLICT or DOCKER_API_ERROR