Docker Networking logopeterindia.net
Knowledge Hub

Docker Networking

How Docker connects containers: the network drivers and when to use each, names and DNS, port publishing, firewalls, Compose, Swarm and Kubernetes context, and troubleshooting tools — with links to the official documentation.

53 topics•8 categories•Updated October 2026

How to Read Docker Networking

7 entries

Most container networking problems come from choosing the wrong network early, not from bugs in Docker. Docker attaches every container to at least one network, and the choice decides what the container can reach and what can reach it. Rules of thumb drawn from the Docker documentation: use a user-defined bridge network by default, because containers on it can find each other by name (containers on the default bridge can reach each other by IP address but not by name); use host networking only when the container should share the host's network stack; use none to cut a container off; use overlay when containers on several Docker hosts must share a network; use macvlan or ipvlan when a container must appear on the physical network; and publish only the ports that need outside access. This page collects the official documentation and tools for each concept. It is a learning guide, so check the Docker documentation for your Docker version before relying on a detail.

01Linux namespaces (Wikipedia)Kernel feature that gives each container its own view of the network, processes and file system. 02Network namespaces (Linux man page)How Linux network namespaces isolate interfaces, routes and firewall rules. 03Network address translation (Wikipedia)NAT, used by default when containers on a bridge reach outside networks. 04Bridging (Wikipedia)Layer 2 bridging, the idea behind the docker0 and user-defined bridge networks. 05Virtual Extensible LAN (Wikipedia)VXLAN, the encapsulation used for overlay network data traffic. 06Domain Name System (Wikipedia)Name resolution, which Docker provides to containers on user-defined networks. 07iptables (Wikipedia)The Linux packet-filtering tool Docker uses by default for its firewall rules.

Core Concepts & Reference

7 entries

What a Docker network is and how to work with networks from the command line.

08Docker networking overviewOfficial overview of how containers connect to each other, the host and outside networks, with the built-in drivers. 09Network driversThe documented drivers: bridge, host, none, overlay, ipvlan and macvlan, with when to use each. 10docker network (CLI reference)Commands for creating, listing, inspecting, connecting, disconnecting and removing networks. 11docker network createCreate a network and set its driver, subnet, gateway and options, including internal networks. 12docker network connectAttach a running container to another network, with optional aliases and a fixed IP. 13docker network inspectShow a network's configuration and which containers are attached to it. 14Docker daemon configurationdaemon.json options, including network defaults such as the default bridge address pool.

The Network Drivers

9 entries

Bridge, host, none, overlay, macvlan and ipvlan, with what each trades between isolation and reach.

15Bridge network driverThe default driver. Containers on one host connect through a bridge. Containers on user-defined bridges can use names or IP addresses, while on the default bridge they can reach each other by IP address only. 16Host network driverThe container shares the host's network namespace, with no NAT and no separate IP address. Published ports are ignored. On Docker Desktop, host networking is opt-in from version 4.34. 17None network driverFully isolates the container from the host and other containers; the container has only a loopback interface. 18Overlay network driverConnects containers across multiple Docker hosts and requires a swarm. The documented ports are 2377/tcp, 7946/tcp and udp, and 4789/udp. 19Macvlan network driverGives each container its own MAC address so it appears as a device on the physical network. Linux only; the switch must allow multiple MAC addresses, and the container cannot reach the host directly. 20IPvlan network driverSimilar to macvlan, but containers share the parent interface's MAC address, which keeps the number of MAC addresses down. 21Bridge network tutorialHands-on tutorial for default and user-defined bridge networks. 22Overlay network tutorialHands-on tutorial for overlay networks. 23Macvlan network tutorialHands-on tutorial for macvlan networks.

Names, DNS & Port Publishing

6 entries

How containers find each other and how traffic gets in from outside.

24Container DNS on user-defined networksThe documentation explains that containers on custom networks use Docker's embedded DNS server at 127.0.0.11, which forwards outside lookups to the host's DNS servers. 25Port publishing and mappingThe -p flag maps host ports to container ports, for example -p 8080:80. Without a host address, ports bind to all addresses; use -p 127.0.0.1:8080:80 to limit access to the host. 26Networking in Docker ComposeCompose sets up a network for the application so services can reach each other by service name, and lets you define more networks. 27Compose file: networksReference for declaring networks, drivers, subnets and external networks in a Compose file. 28Legacy container linksThe older --link feature, kept for reference; user-defined networks are the current approach. 29Docker container run referenceNetwork-related options of docker run, such as --network, --publish and --network-alias.

Firewalls, Security & IPv6

6 entries

Keeping published ports and networks under control.

30Packet filtering and firewallsHow Docker creates its own firewall rules. The documentation says ufw rules do not effectively control published ports, because Docker handles that traffic in the nat table before the INPUT chain. 31nftables with DockerUsing nftables as the firewall backend, which the documentation labels experimental. 32iptables with DockerDocker's default iptables rules and how they interact with the host firewall. 33IPv6 with DockerEnabling IPv6 for the daemon and for networks. 34Docker Engine securitySecurity overview for the Docker daemon, containers and networks. 35Encrypting overlay trafficThe --opt encrypted option uses IPsec at the VXLAN level and, per the documentation, has a performance cost to test before production.

Docker Desktop, Swarm, Podman & Kubernetes

6 entries

Where Docker networking differs on other platforms and runtimes.

36Docker Desktop networkingHow Docker Desktop connects containers, the host and outside networks, including its proxy and VPN behaviour. 37Swarm mode networkingOverlay networks, ingress routing and service discovery in Docker Swarm. 38Podman networkPodman's network commands for rootless and rootful containers. 39NetavarkContainer network stack used by Podman. 40Container Network Interface (CNI)Specification for plugins that configure container networking, used widely with Kubernetes. 41Kubernetes: services, load balancing and networkingHow Kubernetes networks pods and exposes services.

Troubleshooting Tools & Source

5 entries

Tools for inspecting traffic and the open-source engine itself.

42netshootContainer image packed with network troubleshooting tools. GitHub lists v0.16 as the latest release, from January 2026. 43Moby (Docker Engine source)Open-source project behind Docker Engine. GitHub lists v29.9.2 as the latest release, from October 2026. 44tcpdumpCommand-line packet capture for traffic on container interfaces. 45WiresharkPacket analyser for captured container traffic. 46Open Container InitiativeStandards for container images and runtimes.

Related Pages

7 entries

Neighbouring pages on this site.

47DockerDocker resources. 48ContainerizationContainerization hub. 49Container Networking SolutionsCNI plugins and container network products. 50Kubernetes Networking SolutionsNetworking for Kubernetes. 51Container Security ToolsSecurity tools for containers. 52Container EnginesContainer runtimes and engines. 53NetworkingNetworking hub.

Frequently Asked Questions

Why can't my containers find each other by name?

On the default bridge network, containers can reach each other by IP address but not by name. On a user-defined network (for example one created with docker network create), containers can use names or IP addresses. Put the containers on the same user-defined network, or use Docker Compose, which creates one for the application.

Which Docker network type should I use?

Start with a user-defined bridge for containers on one host. Use host networking when the container should share the host's network stack and you accept the loss of isolation, none to disable networking, overlay for containers across several Docker hosts in a swarm, and macvlan or ipvlan when a container must appear on the physical network.

Do published ports bypass my host firewall?

The Docker documentation says Docker creates its own firewall rules and that traffic to published ports is handled before it reaches the chains ufw uses, so ufw rules do not effectively control published ports. Limit exposure by publishing only what is needed, binding to 127.0.0.1 where possible, and reading the packet-filtering page for your Docker version.

How do I publish a port only to the Docker host?

Include the loopback address in the publish flag, for example -p 127.0.0.1:8080:80, so only the Docker host can reach it. Without a host address, Docker binds published ports to all host addresses.

Does host networking work on Docker Desktop?

Docker's documentation says host networking is an opt-in feature in Docker Desktop 4.34 and later, with limits such as working only at layer 4 and supporting only Linux containers.

Where does the information on this page come from?

Mainly the official Docker documentation, the Moby and netshoot repositories, and Wikipedia and Linux man pages for background. Docker changes its networking behaviour between versions, so check the documentation for your version.