Docker Networking
Docker networking allows containers to connect to and communicate with each other, and with
the external world. The following table lists the networking options provided by docker:
Network Description
Bridge The default network driver.
Host Remove network isolation between the container and the Docker host.
none Completely isolate a container from the host and other containers.
overlay Overlay networks connect multiple Docker daemons together.
ipvlan IPvlan networks provide full control over both IPv4 and IPv6 addressing.
macvlan Macvlan networks allow you to assign a MAC address to a container, making it
appear as a physical device on your network.
IP address and Hostname
By default, the container gets an IP address for every Docker network it attaches to. A
container receives an IP address out of the IP subnet of the network. Each network has a
default subnet mask and gateway. You can use the --ip or --ip6 flags to specify the
container's IP address on that particular network.
In the same way, a container's hostname defaults to be the container's ID in Docker. You
can override the hostname using --hostname.
DNS services
Containers use the same DNS servers as the host by default, but you can override this with –dns.
By default, containers inherit the DNS settings as defined in the /etc/[Link] configuration
file. Containers that attach to the default bridge network receive a copy of this file. Containers
that attach to a custom network use Docker's embedded DNS server. The embedded DNS server
forwards external DNS lookups to the DNS servers configured on the host.
1-Bridge network driver
In terms of Docker, a bridge network uses a software bridge which lets containers connected to
the same bridge network communicate, while providing isolation from containers that aren't
connected to that bridge network. The Docker bridge driver automatically installs rules in the
host machine so that containers on different bridge networks can't communicate directly with
each other.
Bridge networks apply to containers running on the same Docker daemon host. For
communication among containers running on different Docker daemon hosts, you can either
manage routing at the OS level, or you can use an overlay network.
In addition to the default bridge, you can also create your own custom bridge (user-defined
bridge) by running the command docker network create -d bridge my-bridge.
Differences between user-defined bridges and the default bridge:
User-defined bridges provide automatic DNS resolution between containers.
User-defined bridges provide better isolation.
Containers can be attached and detached from user-defined networks on the fly.
Linked containers on the default bridge network share environment variables.
Containers connected to the same user-defined bridge network effectively expose all ports to
each other. For a port to be accessible to containers or non-Docker hosts on different networks,
that port must be published using the -p or --publish flag.
2-Overlay network driver
The overlay network driver creates a distributed network among multiple Docker daemon
hosts. Overlay networks are often used to create a connection between Swarm services, but
you can also use it to connect standalone containers running on different hosts. When using
standalone containers, it's still required that you use Swarm mode to establish a connection
between the hosts.
Overlay networks are often used to create a connection between Swarm services, but you can
also use it to connect standalone containers running on different hosts. When using standalone
containers, it's still required that you use Swarm mode to establish a connection between the
hosts.
3- Host network driver
If you use the host network mode for a container, that container's network stack isn't isolated
from the Docker host (the container shares the host's networking namespace), and the container
doesn't get its own IP-address allocated. For instance, if you run a container which binds to port
80 and you use host networking, the container's application is available on port 80 on the host's
IP address.
Host mode networking can be useful for the following use cases:
To optimize performance
In situations where a container needs to handle a large range of ports
This is because it doesn't require network address translation (NAT), and no "userland-proxy" is
created for each port.
The host networking driver only works on Linux hosts, and is not supported on Docker Desktop
for Mac, Docker Desktop for Windows, or Docker EE for Windows Server.
4- Macvlan network driver
Some applications, especially legacy applications or applications which monitor network traffic,
expect to be directly connected to the physical network. In this type of situation, you can use the
macvlan network driver to assign a MAC address to each container's virtual network interface,
making it appear to be a physical network interface directly connected to the physical network.
In this case, you need to designate a physical interface on your Docker host to use for the
Macvlan, as well as the subnet and gateway of the network.
Create a Macvlan network
When you create a Macvlan network, it can either be in bridge mode or 802.1Q trunk bridge
mode.
In bridge mode, traffic goes through a physical device on the host.
In 802.1Q trunk bridge mode, traffic goes through an 802.1Q sub-interface which
Docker creates on the fly. This allows you to control routing and filtering at a more
granular level.
Bridge mode
To create a macvlan network which bridges with a given physical network interface, use --driver
macvlan with the docker network create command. You also need to specify the parent, which
is the interface the traffic will physically go through on the Docker host.
docker network create -d macvlan \
--subnet=[Link]/24 \
--gateway=[Link] \
-o parent=eth0 pub_net
802.1Q trunk bridge mode
If you specify a parent interface name with a dot included, such as eth0.50, Docker interprets
that as a sub-interface of eth0 and creates the sub-interface automatically.
docker network create -d macvlan \
--subnet=[Link]/24 \
--gateway=[Link] \
-o parent=eth0.50 macvlan50
IPvlan network driver
The IPvlan driver gives users total control over both IPv4 and IPv6 addressing. The VLAN driver
builds on top of that in giving operators complete control of layer 2 VLAN tagging and even
IPvlan L3 routing for users interested in underlay network integration.