Nimendra's Notes 🪴

Docker networking (Advanced)

3 min read

kubernetes kubernetes/networking

https://docker-k8s-lab.readthedocs.io/en/latest/lab-environment.html#vagrant-with-one-node-docker-engine
08. Docker Networking > Single host Bridge networks

Core Idea

docker0 is Docker’s default bridge: containers attach to it, reach each other and the internet through it, and can be reached from the host, with other network drivers as alternatives.

  • What docker0 is and how it works, with a running-container example.
  • Container communication: container to container, container to internet, and host access.
  • Alternative Docker networks beyond the default bridge.

docker0 Bridge in Docker Networking

What is docker0?

docker0 is a virtual bridge network automatically created by Docker when it is installed. It is the default network that connects containers running on the same host.

When a container is started using the default bridge network, Docker connects it to docker0 and assigns it an IP address from the default subnet (172.17.0.0/16).

How docker0 Works

Network Namespaces & Veth > Veth Devices (Virtual Ethernet Devices)

When you run a container without specifying a custom network, Docker:

  1. Creates a virtual Ethernet interface (veth) for the container.
  2. Links it to docker0 as a bridge.
  3. Assigns an IP address to the container from the 172.17.0.0/16 subnet.
  4. Uses NAT (Network Address Translation) to allow external internet access.

Example: Running a Container

docker run -d nginx
  • The container gets an IP like 172.17.0.2.
  • A veth pair is created:
    • One end is inside the container (eth0).
    • The other end is attached to docker0.

*Check if docker0 Exists

ip link show docker0

Example output:

4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default
    link/ether 02:42:48:61:79:a0 brd ff:ff:ff:ff:ff:ff
  • state DOWN → No containers are running.
  • link/ether 02:42:48:61:79:a0 → MAC address of docker0.

Check docker0 IP and Subnet

ip addr show docker0

Example:

4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...
    inet 172.17.0.1/16 scope global docker0
  • 172.17.0.1/16 → Gateway IP for containers.
  • Containers will get IPs like 172.17.0.2, 172.17.0.3, etc.

Container Communication in docker0

Container-to-Container Communication

  • Containers in docker0 can communicate using their internal IPs (172.17.x.x).
  • Example: From 172.17.0.2, you can ping 172.17.0.3.

Container-to-Internet Communication

  • Containers do not have public IPs.
  • They access the internet via NAT (masquerading) through the host.
  • The host machine acts as a router using iptables rules.

Accessing a Container from the Host

You can reach a container using its IP:

curl 172.17.0.2

But this won’t work from another machine, as the IP is private.

To expose a port to the host, use:

docker run -d -p 8080:80 nginx

Now, you can access it using http://localhost:8080.

Alternative Docker Networks

  • Bridge (docker0) → Default, NAT-based networking.
  • Host → Shares the host’s network stack.
  • Overlay → For multi-host communication in Swarm.
  • Macvlan → Assigns real network IPs to containers.

Graph View