Docker Networking

Docker Networking - How packets flow from Internet → Host NIC (eth0) → Docker bridge/veth → Container application.

1️⃣ Linux Network Flow (Foundation)

Internet → Router → Host Network → NIC (eth0) → Kernel → Application

Explanation:

• Internet: External traffic source
• Router: Forwards packets to your machine
• Host Network: Your OS networking stack
• NIC (eth0): Network Interface Card (entry point)
• Kernel: Decides where packet goes (port, process, firewall, routing)
• Application: Final receiver

2️⃣ What is a Bridge (docker0)

Flow: Internet → eth0 → docker0 (bridge) → container1

└──→ container2

Definition: A bridge is a virtual switch inside the host that connects multiple containers.

Key Points:

• docker0 is a Linux bridge created by Docker
• Containers connect to bridge using veth pairs
• Bridge forwards traffic between containers
• Containers get private IPs (e.g., 172.17.x.x)
• Uses NAT to access internet

3️⃣ What is Host Network

Flow: Internet → eth0 → Container (directly, no bridge)

Definition: Container shares the host’s network stack and NIC directly.

Key Points:

• No docker0 bridge
• No veth pair created
• Container uses host NIC (eth0) directly
• No separate container IP (same as host)
• No NAT involved, kernel routes traffic directly to process

4️⃣ What is None Network

Definition: Container runs with zero network access.

Key Points:

• No bridge attachment
• No veth connected to host network
• No access to eth0 or internet
• Only loopback interface (lo) exists inside container

5️⃣ What is Custom Bridge Network

Flow: Internet → eth0 → custom-bridge (user-defined) → containerA

└──→ containerB

Definition: A user-created Linux bridge network managed by Docker instead of the default docker0.

Key Points:

• Docker creates a separate Linux bridge (not docker0)
• Containers connect to this bridge using veth pairs
• Bridge forwards traffic between containers
• Containers get IPs from a different private subnet (e.g., 172.18.x.x)
• NAT is used for outbound internet via host NIC (eth0)

6️⃣ What is Overlay Network (Multi-Host)

Flow: Internet → Node NIC (eth0) → Overlay Network (VXLAN tunnel) → Container on another host

Definition: A virtual network that connects containers across multiple Docker hosts.

Key Points:

• Creates virtual network tunnels between hosts
• Each host still uses its own NIC (eth0)
• Containers get virtual IPs across nodes
• Traffic is encapsulated, sent over host network, then decapsulated on destination node
• Enables cross-host container communication as if on same network