Docker Networking Drivers: Bridge, Host, Macvlan and Overlay

Docker containers see only a virtual network interface — what that interface connects to depends on the network driver you choose. The default bridge driver works for single-host apps, overlay spans multiple Docker hosts, and macvlan makes containers look like physical devices on your LAN. This guide explains each built-in driver, when to use it, and shows the docker network create commands that provision them.

The Built-in Drivers

• bridge — default. A software bridge isolates containers on one host; external access only via published ports (-p).
• host — removes network isolation; the container shares the host's network stack directly.
• none — no network; use with custom CNI setups.
• overlay — connects daemons across hosts (Swarm); VXLAN-encapsulated, includes service discovery.
• macvlan — assigns a real MAC to each container so it appears as a physical device on the parent network.
• ipvlan — like macvlan but containers share the parent MAC and are addressed by IP/VLAN.

User-Defined Bridge Networks

User-defined bridges beat the default bridge: containers get automatic DNS resolution by name and can be attached to multiple networks. Create one and run a container on it:

docker network create my-net
docker run -d --name web --network my-net -p 8080:80 nginx
docker network connect my-net my-nginx

Containers on the same user-defined bridge can reach each other on all ports; anything outside needs a published port.

Overlay Networks for Multi-Host

Overlay lets containers on different Docker hosts talk without OS-level routing — the data plane is VXLAN over the underlay, and DNS-based service discovery resolves web to db wherever they run:

docker network create -d overlay --attachable my-overlay

Use overlay when applications span several hosts (Swarm services); use bridge when everything runs on one host.

Macvlan: Containers as LAN Devices

Legacy or traffic-sniffing applications sometimes expect a direct physical presence. Macvlan binds containers to a parent interface and gives each a MAC and a routable IP from the external subnet — no NAT, no port mapping:

docker network create -d macvlan   --subnet=192.168.86.0/24   --gateway=192.168.86.1   -o parent=eth0 my-macvlan-net

Two caveats: macvlan containers cannot talk to the Docker host itself (kernel restriction — add a second bridge connection if needed), and the environment must tolerate many MACs on the upstream switch port. The 802.1Q trunk variant uses a parent sub-interface such as eth0.10 to extend a specific VLAN straight into containers.

Which Driver Should You Use?

• Single host, simple app → default or user-defined bridge.
• Performance, full host visibility → host.
• Swarm / multi-host → overlay.
• Containers must look physical / VLAN segmentation at L2 → macvlan (or ipvlan where MAC limits apply).

For the underlying L2 concepts Docker builds on, see Linux VLAN tagging with ip link and the bridge-VLAN behavior in MikroTik bridge VLAN filtering.

原文链接：https://docs.docker.com/engine/network/