types of docker networks

In this blog post, I wanted to discuss about some of the different docker network types, their difference and how they work.

bridges

A bridge network uses a software bridge which allows containers connected to the same bridge network to communicate, while providing isolation from containers which are not connected to that bridge network.
User-defined bridges provide automatic DNS resolution between containers, containers on the default bridge network can only access each other by IP addresses.
Imagine an application with a web front-end and a database back-end. If you call your containers web and db , the web container can connect to the db container at db , no matter which Docker host the application stack is running on.

host

If you use the host network mode for a container, that container’s network stack is not isolated from the Docker host (the container shares the host’s networking namespace), and the container does not get its own IP-address allocated.
For instance, if you run a container which binds to port 80 and you use host networking, the container’s application is available on port 80 on the host’s IP address.
Therefore, we don’t actually need to expose ports anymore e.g. -p 80:80

ipvlan & macvlan

The difference between ipvlans and macvlans, is that macvlans assign an unique mac address to each container’s virtual network driver. Ipvlans will use the same mac address as the host.

It is essentially a form of bridged networking, the container will directly get an IP from the local physical network.
It appears to be a physical network interface that is directly connected to the physical network, e.g if the docker host is on the network 192.168.0.0/24, the docker container in a macvlan will also use an IP in that range.

macvlans

However, this can create problems as the docker host’s network adapter may filter out traffic not intended for that host (via mac address) therefore, promiscuous mode made be required.
You need to specify the IP address manually for each container, there is no DHCP. You need to ensure the IP address you assign is not being used in your network.
There are two modes: bridge and 802.1q mode.

ipvlans

Two Modes: L2 - mac addresses (default) & L3 - IP
Shares the host’s MAC address with the containers whilst having a IP address from the local network.

Example:

docker network create -d ipvlan \
    --subnet 192.168.0.0/24 \
    --gateway 192.168.0.1 \
    -o parent=eth0 \
    ipvlan_network

iplan L3

Containers are connected to the host as if its like a router
There are no ARP requests or mac address traffic
Multiple subnets can exists and they can communicate with one-another
By default containers won’t be able to communicate with anything outside of the ipvlan network, as the router does not know how to reach them. You need to create static routes to go the docker’s host ip address - as your docker host is becomes a router.

# Create the docker network
$ docker network create -d ipvlan \
    --subnet 192.168.94.0/24 \
    -o parent=eth0 \
    -o ipvlan_mode=l3 \
    --subnet 192.168.95.0/24 \	
    ipvlan_network

# run some containers within the network
 
docker run -itd --rm --network ipvlan_network --ip 192.168.95.7 --name nginx nginx
docker run -itd --rm --network ipvlan_network --ip 192.168.95.8 --name busybox busybox
 
docker run -itd --rm --network ipvlan_network --ip 192.168.94.7 --name nginx1 nginx
docker run -itd --rm --network ipvlan_network --ip 192.168.94.8 --name busybox1 busybox