How Docker’s bridge0 (docker0) Works: Inside the Container Network Bridge

Docker0 Bridge

After installing Docker on Ubuntu, the host automatically creates a network interface named docker0 with IP 172.17.0.1/16. The kernel also adds a static route so that any packet destined for 172.17.0.0/16 is sent via docker0.

When a container (e.g., mycon) is started, it receives two interfaces: lo (loopback) and eth0. eth0 gets an IP like 172.17.0.2/16, sharing the same subnet as the host's docker0. The container’s default gateway is the host’s docker0 address, allowing the container to reach external networks.

The host also creates a veth pair for each container; one end appears in the container as eth0, the other end (e.g., veth7537a16) is attached to docker0. Thus docker0 functions as a Linux bridge, similar to a layer‑2 switch, forwarding Ethernet frames between connected devices without needing IP configuration on the bridge ports.

The bridge’s IP ( 172.17.0.1) serves as the default gateway for containers, and Docker assigns container IPs from the bridge’s subnet automatically. --bip=CIDR: Set the IP address and subnet of docker0 (e.g., 192.168.1.0/24). --fixed-cidr=CIDR: Restrict the IP range that containers can obtain, must be within the bridge’s subnet. --mtu=BYTES: Define the MTU for docker0.

Users can also create a custom bridge (e.g., br0) and start the Docker daemon with --bridge=br0:

$ sudo ip link add name br0 type bridge
$ sudo ifconfig br0 188.18.0.1

iptables Rules

Docker adds NAT and filter rules to enable container‑to‑external communication. A typical NAT rule is:

-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE

This performs SNAT for packets originating from containers, making them appear as if they come from the host.

When a container publishes a port (e.g., docker run -d -p 3000:3000 ...), Docker adds DNAT and ACCEPT rules so that traffic to the host’s port 3000 is forwarded to the container’s IP and port.

Docker’s default forward rule allows all inter‑container traffic: -A FORWARD -i docker0 -o docker0 -j ACCEPT If the daemon is started with -icc=false, this rule becomes DROP, disabling container‑to‑container communication unless --link is used.

The kernel’s IP forwarding must be enabled ( cat /proc/sys/net/ipv4/ip_forward returns 1) for traffic to traverse between interfaces.

Container DNS and Hostname

Each container gets its own /etc/hostname, /etc/hosts, and /etc/resolv.conf files, which are virtual mounts created at start‑up. Instead of editing these files directly, Docker provides options: -h HOSTNAME or --hostname=HOSTNAME: Set the container’s hostname (written to /etc/hostname and /etc/hosts). --dns=IP_ADDRESS: Configure DNS servers for the container (written to /etc/resolv.conf).

Example:

$ docker run -it --name mycon -h lion --dns=8.8.8.8 ubuntu:14.04

Summary

The article demonstrates how Docker’s default docker0 bridge and related iptables rules implement the bridge network driver, relying on Linux IP forwarding and NAT. Understanding these mechanisms, along with custom bridge creation and DNS/hostname configuration, is essential for mastering Docker networking.