Prerequisite Docker Networking

Welcome. This lesson explains how Docker implements container networking on a single host. We’ll cover Docker’s built-in network modes, how network namespaces and veth pairs connect containers to the host bridge, and how Docker exposes container services to external clients. Environment assumed: a single Docker host with an external Ethernet interface eth0 on the local network (example IP 192.168.1.10).

Docker networking modes (overview)

Docker provides several networking modes. The table below summarizes their purpose and a simple example command for each.

Mode	Description	Example
`none`	Container is isolated from all networks (only loopback by default).	`docker run --network none nginx`
`host`	Container shares the host’s network namespace (no isolation).	`docker run --network host nginx`
`bridge` (default)	Containers are placed in their own network namespaces and attached to a host bridge (usually `docker0`).	`docker run nginx` or `docker run -p 8080:80 nginx`

For more details, see the official Docker networking documentation: Docker Networking.

none network

The none network gives the container no network interfaces that provide external connectivity. By default the container will only have the loopback interface up. You can add interfaces manually if required. Example:

$ docker run --network none nginx

Multiple containers started with --network none cannot reach each other or external hosts unless you explicitly configure additional interfaces or attach them to a network.

host network

When you run a container with --network host, it uses the host’s network namespace directly. There is no network isolation between host and container. Example:

$ docker run --network host nginx

Because the host and container share the same network stack:

A service inside the container listening on port 80 will be reachable on the host’s port 80.
Two containers cannot both bind the same host port at the same time when using the host network.

Bridge network (default)

The default bridge network is the most common mode. Docker creates an internal, host-local bridge (typically called docker0) and places containers in separate network namespaces connected to that bridge via virtual ethernet (veth) pairs. Common characteristics:

Historically the bridge uses the 172.17.0.0/16 range, though the exact prefix can vary by Docker version and host configuration (you may see /24 on some systems).
The host has a docker0 interface that acts as an L2/L3 switch for all containers attached to the bridge.

You can inspect Docker networks and host interfaces:

$ docker network ls
NETWORK ID          NAME                DRIVER              SCOPE
2b60087261b2        bridge              bridge              local
0beb4870b093        host                host                local
99035e02694f        none                null                local

$ ip link
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000
    link/ether 02:42:ac:11:00:08 brd ff:ff:ff:ff:ff:ff
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default
    link/ether 02:42:88:56:50:83 brd ff:ff:ff:ff:ff:ff

Inspect the docker0 IP address:

$ ip addr show docker0
3: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:88:56:50:83 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/24 brd 172.17.0.255 scope global docker0
       valid_lft forever preferred_lft forever

Note: the Docker network named bridge corresponds to the host interface docker0.

Network namespaces and veth pairs

When Docker launches a container in bridge mode:

Docker creates a new network namespace for the container.
It creates a veth pair (virtual ethernet pair). One end is attached to the host bridge (docker0), and the other end is moved into the container’s network namespace and typically named eth0.

You can list network namespaces (platform differences may apply):

$ ip netns
b3165c10a92b

On the host, a veth endpoint attached to the bridge looks like:

$ ip link
...
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
    link/ether 02:42:9b:5f:d6:21 brd ff:ff:ff:ff:ff:ff
8: vethbb1c343@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP mode DEFAULT group default
    link/ether 9e:71:37:83:9f:50 brd ff:ff:ff:ff:ff:ff link-netnsid 1

Inside the container’s network namespace the paired interface appears as eth0:

$ ip -n b3165c10a92b link
7: eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0

Inspecting the container’s IP address inside its namespace:

$ ip -n b3165c10a92b addr
7: eth0@if8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 02:42:ac:11:00:03 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.17.0.3/24 brd 172.17.0.255 scope global eth0
       valid_lft forever preferred_lft forever

Docker records the network sandbox information in docker inspect output. Example fragment:

"NetworkSettings": {
    "Bridge": "",
    "SandboxID": "b3165c10a92b50edce4c8aa5f37273e180907ded31",
    "SandboxKey": "/var/run/docker/netns/b3165c10a92b",
    ...
}

How veth indices are assigned: the Linux kernel assigns interface indices; the two ends of a veth pair typically appear with consecutive indices (for example, 7 & 8, 9 & 10). Conceptually each pair is a virtual cable connecting the container namespace to the host bridge.

A diagram of a Docker bridge network (docker0) showing three containers connected via virtual ethernet pairs (veth) to their eth0 interfaces and the bridge, with addresses like 172.17.0.3 and host 192.168.1.10. Interface names and container IDs are labeled.

Container-to-container and host access

Containers attached to the same bridge network can communicate directly using their private IP addresses (for example 172.17.0.3). The host can also reach containers via their bridge IPs.

Port mapping (host-to-container)

By default, containers on the bridge network are not reachable from external networks. To expose a container service to external clients, use port publishing:

$ docker run -p 8080:80 nginx

When you publish a port, Docker configures packet forwarding so that traffic arriving at the host on port 8080 is forwarded to the container’s IP and port 80. Under the hood, Docker inserts iptables NAT (DNAT) rules to translate the destination address and port to the container. Inspect the NAT table to find Docker-created rules. For example:

$ sudo iptables -nvl -t nat
Chain DOCKER (2 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0
DNAT       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 to:172.17.0.2:80

From the host you can also reach a container directly using its bridge IP:

$ curl http://172.17.0.3:80
Welcome to nginx!

If ip netns does not show Docker-created namespaces on your system, you may need to make Docker’s namespace directory visible to ip netns, or use tools like nsenter or docker exec to inspect network state. Platform-specific details vary; consult your OS or Docker vendor documentation for exact steps.

Summary

Docker’s default bridge network (bridge / host interface docker0) acts as a host-local L2/L3 switch connecting container network namespaces to the host.
For each container Docker creates a network namespace and a veth pair; one end is attached to the host bridge, the other becomes the container’s eth0.
Containers can communicate on the bridge network using their private IPs. To make a container service available externally, publish ports with -p/--publish and Docker will add iptables NAT rules to forward traffic.

Introduction

Core Concepts

Scheduling

Logging & Monitoring

Application Lifecycle Management

Cluster Maintenance

Security

Storage

Networking

Design and Install a Kubernetes Cluster

Install "Kubernetes the kubeadm way"

Troubleshooting

Helm Basics (2025 Updates)

Kustomize Basics (2025 Updates)

Other Topics

Mock Exams

Prerequisite Docker Networking

Docker networking modes (overview)

none network

host network

Bridge network (default)

Network namespaces and veth pairs

Container-to-container and host access

Port mapping (host-to-container)

Summary

Watch Video

​Docker networking modes (overview)

​none network

​host network

​Bridge network (default)

​Network namespaces and veth pairs

​Container-to-container and host access

​Port mapping (host-to-container)

​Summary

Watch Video

Docker networking modes (overview)

none network

host network

Bridge network (default)

Network namespaces and veth pairs

Container-to-container and host access

Port mapping (host-to-container)

Summary