Docker Container Network Configuration Explained with 6 Diagrams

Docker default networks

After installation Docker creates three default networks. List them with:

# docker network ls
NETWORK ID   NAME    DRIVER   SCOPE
cd97bb997b84 bridge  bridge   local
0a04824fc9b6 host    host     local
4dcb8fbdb599 none    null     local

Docker uses a Linux bridge ( docker0) on the host. When a container starts Docker assigns it an IP from the bridge subnet and sets the bridge as the default gateway, allowing containers on the same host to communicate directly via their IPs.

Docker network modes

bridge – default mode; container connects to the docker0 bridge ( --network bridge or omit the flag).

host – container shares the host’s network namespace ( --network host).

container – container shares the network namespace of an existing container ( --network container:NAME_OR_ID).

none – container gets an isolated namespace with no interfaces or IP configuration ( --network none).

Bridge mode

When Docker starts it creates a virtual bridge named docker0. Each container receives a veth pair: one end ( eth0) inside the container, the other end attached to docker0. Docker adds NAT rules with iptables to enable port forwarding. The bridge behaves like a Layer‑2 switch connecting all containers on the host.

Example:

# docker run -it --name ti --rm busybox
# ifconfig   # eth0 gets 172.17.0.x from the bridge

External networks cannot address containers directly; you must publish ports with -p or --publish to make services reachable from outside.

Container mode

Share the network namespace of an existing container:

# docker run -dit --name b3 busybox
# docker exec -it b3 ifconfig   # eth0 172.17.0.2
# docker run -it --rm --network container:b3 busybox
# ifconfig   # eth0 also shows 172.17.0.2

File‑system isolation remains, so changes in /tmp of one container are not visible in the other.

Host mode

Use the host’s network stack directly:

# docker run -it --rm --network host busybox
# ifconfig   # shows host interfaces (docker0, ens33, lo)

The container can bind to any host port without NAT, offering the best performance, but port conflicts and reduced isolation are possible.

None mode

Create a container with an isolated namespace and no network interfaces:

# docker run -it --rm --network none busybox
# ifconfig   # only lo is present

Manual configuration of interfaces, IP addresses, and routing is required if connectivity is needed.

Linux network namespaces

Namespaces can be created with ip netns add NAME. Each namespace gets its own set of network resources.

# ip netns add ns0
# ip netns list
ns0

The loopback interface exists but is down by default. Bring it up:

# ip netns exec ns0 ip link set lo up
# ip netns exec ns0 ping 127.0.0.1   # succeeds after the interface is up

veth pair

Create a virtual Ethernet pair and move each end into a different namespace to enable direct communication:

# ip link add type veth
# ip link set veth0 netns ns0
# ip link set veth1 netns ns1
# ip netns exec ns0 ip link set veth0 up
# ip netns exec ns0 ip addr add 192.0.0.1/24 dev veth0
# ip netns exec ns1 ip link set veth1 up
# ip netns exec ns1 ip addr add 192.0.0.2/24 dev veth1
# ip netns exec ns0 ping 192.0.0.2   # successful communication

Custom Docker bridge

Create a user‑defined bridge with a specific subnet and gateway:

# docker network create mybridge -d bridge --subnet 192.168.2.0/24 --gateway 192.168.2.1
# docker network ls
NETWORK ID   NAME       DRIVER   SCOPE
...          mybridge   bridge   local

Run a container on the custom bridge:

# docker run -it --name b1 --network mybridge busybox ifconfig
eth0  inet 192.168.2.2  netmask 255.255.255.0  broadcast 192.168.2.255

Port publishing

Map container ports to host ports with -p. Formats: -p 8080 – map to a random host port. -p 80:8080 – map host port 80 to container port 8080. -p 192.168.1.100:80:8080 – bind to a specific host IP.

# docker run -dit --name web1 -p 192.168.203.138::80 httpd
# docker port web1
80/tcp -> 192.168.203.138:49153

Docker automatically creates the corresponding iptables DNAT and MASQUERADE rules, which are removed when the container stops.

Hostname and DNS configuration

Inject a hostname at container start:

# docker run -it --name t1 --network bridge --hostname myhost --rm busybox hostname
myhost

Specify custom DNS servers:

# docker run -it --network bridge --dns 114.114.114.114 --rm busybox cat /etc/resolv.conf
nameserver 114.114.114.114

Add custom host entries:

# docker run -it --network bridge --add-host www.example.com:1.1.1.1 --rm busybox cat /etc/hosts
1.1.1.1 www.example.com

Connecting to a remote Docker daemon

Specify the daemon host with the -H flag: # docker -H 192.168.203.138:2375 ps This summary provides a step‑by‑step reference for Docker container networking, covering default networks, the four network modes, Linux namespaces, veth pairs, custom bridge creation, port publishing, and hostname/DNS configuration.