instruction: Create a comprehensive Dockerfile for networking applications with best practices
output: ```dockerfile
  from the host's interface as the --subnet in the
  docker network create. The container will be attached to the same network as
  the host interface as set via the -o parent= option.Create the IPvlan network and run a container attaching to it:
  
  # IPvlan (-o ipvlan_mode= Defaults to L2 mode if not specified)
  $ docker network create -d ipvlan \
   --subnet=192.168.1.0/24 \
   --gateway=192.168.1.1 \
   -o ipvlan_mode=l2 \
   -o parent=eth0 db_net
  
  # Start a container on the db_net network
  $ docker run --net=db_net -it --rm alpine /bin/sh
  
  # NOTE: the containers can NOT ping the underlying host interfaces as
  # they are intentionally filtered by Linux for additional isolation.
  The default mode for IPvlan is l2. If -o ipvlan_mode= is left unspecified,
  the default mode will be used. Similarly, if the --gateway is left empty, the
  first usable address on the network will be set as the gateway. For example, if
  the subnet provided in the network create is --subnet=192.168.1.0/24 then the
  gateway the container receives is 192.168.1.1.To help understand how this mode interacts with other hosts, the following
  figure shows the same layer 2 segment between two Docker hosts that applies to
  and IPvlan L2 mode.
  The following will create the exact same network as the network db_net created
  earlier, with the driver defaults for --gateway=192.168.1.1 and -o ipvlan_mode=l2.
  
  # IPvlan (-o ipvlan_mode= Defaults to L2 mode if not specified)
  $ docker network create -d ipvlan \
   --subnet=192.168.1.0/24 \
   -o parent=eth0 db_net_ipv
  
  # Start a container with an explicit name in daemon mode
  $ docker run --net=db_net_ipv --name=ipv1 -itd alpine /bin/sh
  
  # Start a second container and ping using the container name
  # to see the docker included name resolution functionality
  $ docker run --net=db_net_ipv --name=ipv2 -it --rm alpine /bin/sh
  $ ping -c 4 ipv1
  
  # NOTE: the containers can NOT ping the underlying host interfaces as
  # they are intentionally filtered by Linux for additional isolation.
  The drivers also support the --internal flag that will completely isolate
  containers on a network
  ```