Learn how the docker/container network works.
Different Docker Network Types:
- Bridge (default)
- User-defined bridge
- Host
- Mac Vlan
- Mac Vlan (802.1q)
- IP Vlan (L2)
- IP Vlan (L3)
- Overlay
- None
| Interface | Description |
|---|---|
| eth0 | VM host network interface |
| docker0 | Virtual bridge interface (switch) |
Show the default docker network interface
ubuntu@docker:~$ docker network ls
NETWORK ID NAME DRIVER SCOPE
e2397b67991e bridge bridge local
f6648d670e10 host host local
031ec528726f none null local
ubuntu@docker:~$
Start the first container () with default bridge driver.
ubuntu@docker:~$ docker run -itd --rm --name dnet_bridge busybox
e05bdb96427b458d649c0ca8eb6d800a50dde48c6619df34121f3f6c29b36f6f
ubuntu@docker:~$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
e05bdb96427b busybox "sh" 5 seconds ago Up 4 seconds dnet_bridge
ubuntu@docker:~$
By default, the bridge network applies NAT masq for accessing to external but never expose the container to external network. We need to expose the port if we need the external network to access to our docker container.
ubuntu@docker:~$ docker run -itd --rm -p80:80 --name web01 nginx
e83d9abbea4a909f579a0461c9fb04a8247dd42100b7be08cd701cf9740d856c
ubuntu@docker:~$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
e83d9abbea4a nginx "/docker-entrypoint.…" 4 seconds ago Up 4 seconds 0.0.0.0:80->80/tcp, :::80->80/tcp web01
13f8d2d6f05f busybox "sh" 4 minutes ago Up 4 minutes dns01
e05bdb96427b busybox "sh" 9 minutes ago Up 9 minutes dnet_bridge
ubuntu@docker:~$
Second. Let's define our own bridge network. This is mainly for segregating (isolation) the containers.
ubuntu@docker:~$ docker network create dmz
71a335a2c869afde71ff4d6debf5155b319e65894c7c83dcea1b1d6e208eb882
ubuntu@docker:~$ docker network ls
NETWORK ID NAME DRIVER SCOPE
e2397b67991e bridge bridge local
71a335a2c869 dmz bridge local
f6648d670e10 host host local
031ec528726f none null local
ubuntu@docker:~$ docker run -itd --rm --network dmz -p80:80 --name web01 nginx
9ddc5bd9c13c884237aa7164a4c4f3c17498a68da64c735879eaf479c397a433
ubuntu@docker:~$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
9ddc5bd9c13c nginx "/docker-entrypoint.…" 9 seconds ago Up 8 seconds 0.0.0.0:80->80/tcp, :::80->80/tcp web01
e05bdb96427b busybox "sh" 16 minutes ago Up 16 minutes dnet_bridge
ubuntu@docker:~$
Third. We call it host network. This makes the container runs on the same network as the VM host.
ubuntu@docker:~$ docker run -itd --rm --network host --name web02 nginx
3022063adc651f94e23edd8755c7c9521f40a7b2df157bfc92c66f21016d3842
ubuntu@docker:~$
Forth. We call it MAC-VLAN (bridge mode).
ubuntu@docker:~$ docker network create -d macvlan --subnet 172.31.112.0/20 --gateway 172.31.112.1 -o parent=eth0 vlan1
373a821c44aefb4030109482f9480008bf87a152ad74a6c714cbeaa57f73e6dc
ubuntu@docker:~$ docker network ls
NETWORK ID NAME DRIVER SCOPE
e2397b67991e bridge bridge local
71a335a2c869 dmz bridge local
f6648d670e10 host host local
031ec528726f none null local
373a821c44ae vlan1 macvlan local
ubuntu@docker:~$
ubuntu@docker:~$ sudo ip link set eth0 promisc on
ubuntu@docker:~$
Fifth. We call it MAC-VLAN (802.1q mode).
ubuntu@docker:~$ docker network create -d macvlan --subnet 192.168.20.0/24 --gateway 192.168.20.1 -o parent=eth0.20 vlan20
3634f36fe849afa8d7dfc65589b71aa0c0902bd6bc1ed294e0d258ffc14e640f
ubuntu@docker:~$ docker network ls
NETWORK ID NAME DRIVER SCOPE
e2397b67991e bridge bridge local
71a335a2c869 dmz bridge local
f6648d670e10 host host local
031ec528726f none null local
373a821c44ae vlan1 macvlan local
3634f36fe849 vlan20 macvlan local
ubuntu@docker:~$
ubuntu@docker:~$ docker run -itd --rm --network vlan3 --ip 192.168.94.7 --name dns01 busybox
de504908dc372c0f017a36c4357c70a1f28acd0a7f763bb372642c96e89baef9
ubuntu@docker:~$ docker run -itd --rm --network vlan3 --ip 192.168.94.8 --name dns02 busybox
2dc61bd9a45f828493fe1b55f8786692740baf5079deeddb5cefebe2468aa583
ubuntu@docker:~$ docker run -itd --rm --network vlan3 --ip 192.168.95.9 --name web01 busybox
a1d23a1691d0c2fd33b03d023bc03bb0a282e39a8f254bdf54fbab4d3e46a9de
ubuntu@docker:~$ docker run -itd --rm --network vlan3 --ip 192.168.95.10 --name web02 busybox
9cc2db6492de35f5a2fa230702e5e41ff4bf75bd563eac71bf39d0e7171b0e0f
ubuntu@docker:~$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
9cc2db6492de busybox "sh" 4 seconds ago Up 3 seconds web02
a1d23a1691d0 busybox "sh" 13 seconds ago Up 13 seconds web01
2dc61bd9a45f busybox "sh" 35 seconds ago Up 35 seconds dns02
de504908dc37 busybox "sh" About a minute ago Up About a minute dns01
ubuntu@docker:~$
Sixth. We call it IP-VLAN (L2) - layer_2. This will share the same mac address with the VM host, and must allow 1 mac addr with 20 IP addresses associated on the network.
ubuntu@docker:~$ docker network create -d ipvlan --subnet 172.31.112.0/20 --gateway 172.31.112.1 -o parent=eth0 vlan2
40aadb9f60c3dc889c8b9a30e627d5a314226c204ca48f09375447def53b4ad4
ubuntu@docker:~$
Seventh. We call it IP-VLAN (L3) - layer_3. Everything is connecting to host and host is functioning like router. And we have more control on the traffic.
ubuntu@docker:~$ docker network create -d ipvlan --subnet 192.168.94.0/24 -o parent=eth0 -o ipvlan_mode=l3 --subnet 192.168.95.0/24 vlan3
000b2c4799a4fd62a4435d99eed592ae8fa7ad5b8b797aeb7e06322b477f7ecf
ubuntu@docker:~$ docker network ls
NETWORK ID NAME DRIVER SCOPE
e2397b67991e bridge bridge local
71a335a2c869 dmz bridge local
f6648d670e10 host host local
031ec528726f none null local
000b2c4799a4 vlan3 ipvlan local
ubuntu@docker:~$
* Need to add static route at the router in order for the network to reach back to vlan3.
Eighth. We call it Overlay network. And it is used to link up multiple host, create an overlay network, and create rule to allow the containers (at different host) to talk to each other.
Usually it is used with Docker Swarm.
Last (9th) is None network.
ubuntu@docker:~$ docker run -itd --rm --network none --name xnet busybox
0c21ccbb87d1937dd7ce18da696a5bd7ca1530969a4198992e5852e3d0593d14
ubuntu@docker:~$
Links: