Network Management Free

Isolate environments with dedicated Docker networks, control cross-environment traffic, and secure Docker Swarm communication with overlay encryption.

Overview

By default, all Coolify resources share a single Docker bridge network, meaning any container can communicate with any other container on the same server. Network Management adds granular Docker network isolation:

• Environment isolation — each environment gets its own Docker bridge network
• Shared networks — user-defined networks that span environments for cross-service communication
• Proxy isolation — a dedicated network for the reverse proxy, preventing non-public containers from reaching the proxy
• Swarm overlay encryption — IPsec encryption for Docker Swarm overlay networks
• Per-resource assignment — attach or detach individual resources from specific networks

Configuration

Enable network management via environment variables:

CORELIX_NETWORK_MANAGEMENT=true        # Enable network management
CORELIX_NETWORK_ISOLATION_MODE=environment  # none, environment, or strict
CORELIX_PROXY_ISOLATION=false          # Enable dedicated proxy network
CORELIX_SWARM_OVERLAY_ENCRYPTION=false # IPsec for Swarm overlays
CORELIX_MAX_NETWORKS=200               # Safety limit per server

Isolation Modes

Mode	Behavior
none	Network management enabled but no automatic isolation
environment	Each environment gets its own bridge network automatically
strict	Environment isolation plus proxy isolation enforced

Environment Networks

When isolation is enabled, each environment automatically receives a dedicated Docker bridge network:

• Resources deployed in "production" are on one network
• Resources deployed in "staging" are on a separate network
• Containers in different environments cannot communicate by default

Networks are created automatically when resources are deployed and cleaned up when environments are removed.

Shared Networks

For services that need to communicate across environments (e.g., a shared database used by both staging and production), you can create shared networks:

1. Navigate to Settings > Networks or Server > Networks
2. Click + Create Network
3. Give it a name (e.g., "shared-database")
4. Optionally select the driver (bridge for standalone, overlay for Swarm)
5. Attach resources from any environment to this shared network

Per-Resource Network Assignment

Each resource (application, service, or database) can be attached to or detached from specific networks:

1. Open the resource's detail page
2. Go to the Networks section
3. Select networks to attach or detach
4. Changes take effect on the next deployment

Proxy Isolation

When proxy isolation is enabled, only resources with an FQDN (domain name) are connected to the proxy network. This means:

• Public resources (with an FQDN) are on both the proxy network and their environment network
• Internal resources (without an FQDN) are only on their environment network — they cannot reach the proxy
• The reverse proxy (Traefik or Caddy) only routes traffic to containers on the proxy network

This prevents internal services from accidentally exposing themselves through the proxy.

Enabling Proxy Isolation

CORELIX_PROXY_ISOLATION=true

Or migrate existing servers via the API:

curl -X POST -H "Authorization: Bearer $TOKEN" \
  https://coolify.example.com/api/v1/networks/{serverUuid}/proxy/migrate

Redeployment Required

After enabling proxy isolation, all resources should be redeployed so they are attached to the correct networks. The migration job handles the initial network creation and proxy connection.

Swarm Overlay Encryption

For Docker Swarm clusters, overlay networks can be created with IPsec encryption enabled. This encrypts all traffic between nodes on the overlay network.

CORELIX_SWARM_OVERLAY_ENCRYPTION=true

When enabled, managed overlay networks are created with the --opt encrypted flag, providing encryption for inter-node communication.

Server Network Dashboard

The server-level network management UI shows all managed networks on a server:

1. Navigate to Servers > select a server
2. Open the Networks tab
3. View all managed networks with their scope, driver, status, and connected resources
4. Create, sync, or delete networks from this dashboard

API

List Server Networks

curl -H "Authorization: Bearer $TOKEN" \
  https://coolify.example.com/api/v1/networks/{serverUuid}

Create a Shared Network

curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "shared-backend", "driver": "bridge"}' \
  https://coolify.example.com/api/v1/networks/{serverUuid}

Attach a Resource to a Network

curl -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"network_uuid": "net-abc123"}' \
  https://coolify.example.com/api/v1/networks/resource/application/{appUuid}/attach

Sync Networks from Docker

curl -X POST -H "Authorization: Bearer $TOKEN" \
  https://coolify.example.com/api/v1/networks/{serverUuid}/sync

Troubleshooting

Services can't communicate after enabling isolation

Resources in different environments are on separate networks by design. To allow cross-environment communication:

1. Create a shared network
2. Attach both resources to the shared network
3. Redeploy both resources

Proxy returns 502 after enabling proxy isolation

Ensure all resources with FQDNs are redeployed after migration. Redeploying bakes the correct traefik.docker.network label into each container; the platform injects this label automatically for all resource types (regular applications, Docker Compose applications, and services). The proxy itself joins the proxy network automatically when the first FQDN resource is reconciled.

Intermittent 502s on a resource attached to multiple networks

The platform pins Traefik routing with a traefik.docker.network label so multi-homed containers are always reached over a network the proxy is connected to. If you override this label yourself (in raw compose or label overrides), make sure it points to a network the proxy is actually on — your value always takes precedence.

Network limit reached

The default limit is 200 networks per server. If you hit this limit, review and clean up unused networks, or increase the limit via CORELIX_MAX_NETWORKS.