A user-defined bridge gives a set of containers a network boundary and name-based discovery. Creating the network doesn't attach containers that already exist. You can choose a network at creation or connect a running container afterward. A container can belong to more than one network, so retain an existing attachment when the request requires it. Disconnecting changes membership while leaving the process running. Stopping the process is a different operation with an availability cost. These tasks cover initial attachment, an existing service and a targeted disconnection.
Inspect membership on both the network and the container before declaring the change complete.