Docker Networking: Bridge vs Macvlan vs Overlay

Choosing the wrong Docker network type causes classic headaches: containers that can't see each other, NAT overhead where none is needed, or overlay complexity on a single host. The default bridge works for most single-host stacks, macvlan makes containers look like native LAN devices, and overlay connects containers across multiple Swarm hosts. This tutorial walks through all three with concrete commands, pros and cons, and a troubleshooting section for the most common cross-host connectivity problems.

1. Bridge Networks: Single-Host Stacks

A bridge network lives on one host; the default one uses the 172.17.0.0/16 range and the docker0 virtual interface. Create a dedicated network for a monitoring stack:

docker network create monitor-net
docker run -d --network monitor-net --name prometheus prom/prometheus
docker run -d --network monitor-net --name grafana grafana/grafana

Pros: zero extra config, fast packet path, solid default isolation. Cons: host-only, subnet conflicts possible with multiple bridges, hair-pin NAT for published ports.

2. Macvlan: Containers as LAN Devices

Each macvlan container gets its own MAC and sits directly on your physical LAN — no port mapping, no NAT:

docker network create -d macvlan --subnet=10.1.149.0/24 --gateway=10.1.149.1 -o parent=ens192 lab-macvlan
docker run -d --network lab-macvlan --ip 10.1.149.150 --name zigbee2mqtt my-zigbee-image

Note that Docker's macvlan IPAM does not do DHCP — you must either run a DHCP client inside the container, omit --subnet/--gateway and run dhclient/dhcpcd in the container, or use a DHCP IPAM plugin.

3. Overlay: Multi-Host Swarm Networking

docker swarm init --advertise-addr 10.0.0.1
docker network create -d overlay --attachable webnet
docker service create --replicas 3 --name web --network webnet nginx

Overlay uses VXLAN encapsulation, with built-in DNS and load balancing. Cons: CPU overhead, requires Swarm/Kubernetes, and MTU fragmentation is possible — lower the overlay MTU if you see "fragmentation needed" errors.

Quick Comparison

Troubleshooting Cross-Host Connectivity

• Host can't ping macvlan containers: create a shim interface (ip link add macvlan-shim link eth0 type macvlan mode bridge + IP).
• Overlay MTU mismatch: create with --opt com.docker.network.driver.mtu=1400.
• VXLAN blocked: open UDP 4789 between hosts.
• Swarm DNS failures: ensure identical cluster-store config in /etc/docker/daemon.json.

For Linux server operations around Docker hosts, see our Linux server operations guide, the SONiC GNS3 lab article, and Arista CloudVision AVD with Containerlab.

原文链接：https://www.virtualizationhowto.com/2025/07/docker-networking-tutorial-bridge-vs-macvlan-vs-overlay-for-home-labs/