Display `internal` flag on `network inspect`

Also adds internal network tests for bridge network

Signed-off-by: Chun Chen <ramichen@tencent.com>

api/server/router/network/network_routes.go

@@ -164,6 +164,7 @@ func buildNetworkResource(nw libnetwork.Network) *types.NetworkResource {
 	r.Options = nw.Info().DriverOptions()
 	r.Containers = make(map[string]types.EndpointResource)
 	buildIpamResources(r, nw)
+	r.Internal = nw.Info().Internal()
 
 	epl := nw.Endpoints()
 	for _, e := range epl {

docs/reference/api/docker_remote_api.md

@@ -105,6 +105,7 @@ This section lists each version from latest to oldest.  Each listing includes a
 [Docker Remote API v1.23](docker_remote_api_v1.23.md) documentation
 
 * `GET /containers/json` returns the state of the container, one of `created`, `restarting`, `running`, `paused`, `exited` or `dead`.
+* `GET /networks/(name)` now returns an `Internal` field showing whether the network is internal or not.
 
 
 ### v1.22 API changes

docs/reference/api/docker_remote_api_v1.23.md

@@ -2963,6 +2963,7 @@ Content-Type: application/json
         "foo": "bar"
     }
   },
+  "Internal": false,
   "Containers": {
     "19a4d5d687db25203351ed79d478946f861258f018fe384f229f2efa4b23513c": {
       "Name": "test",

docs/reference/commandline/network_inspect.md

@@ -50,6 +50,7 @@ $ sudo docker network inspect bridge
                 }
             ]
         },
+        "Internal": false,
         "Containers": {
             "bda12f8922785d1f160be70736f26c1e331ab8aaf8ed8d56728508f2e2fd4727": {
                 "Name": "container2",

integration-cli/docker_cli_network_unix_test.go

@@ -621,6 +621,7 @@ func (s *DockerNetworkSuite) TestDockerNetworkInspectCustomSpecified(c *check.C)
 	c.Assert(nr.IPAM.Config[0].Subnet, checker.Equals, "172.28.0.0/16")
 	c.Assert(nr.IPAM.Config[0].IPRange, checker.Equals, "172.28.5.0/24")
 	c.Assert(nr.IPAM.Config[0].Gateway, checker.Equals, "172.28.5.254")
+	c.Assert(nr.Internal, checker.False)
 	dockerCmd(c, "network", "rm", "br0")
 	assertNwNotAvailable(c, "test01")
 }
@@ -1387,3 +1388,19 @@ func (s *DockerSuite) TestDockerNetworkConnectFailsNoInspectChange(c *check.C) {
 	ns1 := inspectField(c, "bb", "NetworkSettings.Networks.bridge")
 	c.Assert(ns1, check.Equals, ns0)
 }
+
+func (s *DockerNetworkSuite) TestDockerNetworkInternalMode(c *check.C) {
+	dockerCmd(c, "network", "create", "--driver=bridge", "--internal", "internal")
+	assertNwIsAvailable(c, "internal")
+	nr := getNetworkResource(c, "internal")
+	c.Assert(nr.Internal, checker.True)
+
+	dockerCmd(c, "run", "-d", "--net=internal", "--name=first", "busybox", "top")
+	c.Assert(waitRun("first"), check.IsNil)
+	dockerCmd(c, "run", "-d", "--net=internal", "--name=second", "busybox", "top")
+	c.Assert(waitRun("second"), check.IsNil)
+	_, _, err := dockerCmdWithError("exec", "first", "ping", "-c", "1", "www.google.com")
+	c.Assert(err, check.NotNil)
+	_, _, err = dockerCmdWithError("exec", "second", "ping", "-c", "1", "first")
+	c.Assert(err, check.IsNil)
+}

man/docker-network-inspect.1.md

@@ -45,6 +45,7 @@ $ sudo docker network inspect bridge
                 }
             ]
         },
+        "Internal": false,
         "Containers": {
             "bda12f8922785d1f160be70736f26c1e331ab8aaf8ed8d56728508f2e2fd4727": {
                 "Name": "container2",