How does Docker networking work and what are the built-in network drivers?
Understand how Docker networking works and the built-in drivers: bridge, host, none, overlay, macvlan, and ipvlan, plus when to use each one.
Expected Interview Answer
Docker networking connects containers to each other, the host, and the outside world through pluggable network drivers; the built-in drivers are bridge, host, none, overlay, macvlan, and ipvlan.
By default containers attach to a bridge network, a private virtual switch on the host where Docker assigns internal IPs and provides DNS-based service discovery on user-defined bridges. The host driver removes network isolation and shares the host's stack directly, none disables networking entirely, overlay spans multiple hosts for Swarm/multi-host clusters, and macvlan/ipvlan give containers their own MAC or IP on the physical LAN. Docker uses a Container Network Model (CNM) with sandboxes, endpoints, and networks to wire these together.
- Isolates container traffic on private virtual networks
- Automatic DNS service discovery on user-defined bridges
- Overlay networks connect containers across multiple hosts
- Host mode gives near-native network performance
- macvlan/ipvlan place containers directly on the physical LAN
- Pluggable drivers extend networking without changing containers
AI Mentor Explanation
Docker networks are like the different ways players communicate on a ground. A bridge network is the team huddle — a private circle where members talk freely by name but outsiders can't join. Host mode is a player shouting on the open PA system with no barrier. Overlay is a coordinated signal shared between two separate grounds during a tour, and 'none' is a fielder deliberately kept out of all communication for a drill.
Step-by-Step Explanation
Step 1
Start on the default bridge
New containers attach to the docker0 bridge, getting a private IP and NAT access to the outside world.
Step 2
Create a user-defined bridge
Run docker network create appnet to get automatic DNS so containers resolve each other by name instead of IP.
Step 3
Connect containers
Launch containers with --network appnet so they share the subnet and can reach one another by container name.
Step 4
Pick host or none when needed
Use --network host for max performance without isolation, or --network none to fully disable networking.
Step 5
Scale across hosts
For multi-host clusters use an overlay network (Swarm) or macvlan/ipvlan to place containers on the physical LAN.
What Interviewer Expects
- Naming all built-in drivers: bridge, host, none, overlay, macvlan, ipvlan
- Understanding default vs user-defined bridge DNS behavior
- When overlay networks are required
- Trade-offs of host networking (performance vs isolation)
- Awareness of the Container Network Model (CNM)
Common Mistakes
- Thinking the default bridge provides DNS name resolution
- Confusing host mode with bridge mode
- Believing overlay works without a Swarm or key-value store
- Forgetting macvlan gives containers a real MAC on the LAN
- Assuming containers on different bridges can talk without linking
Best Answer (HR Friendly)
“Docker networking is how containers talk to each other and the internet. Docker offers several modes: a private virtual network for isolated apps, a mode that shares the host's connection, one that spans several machines, and one that fully disconnects a container.”
Code Example
# List networks and their drivers
docker network ls
# Create a user-defined bridge (gives automatic DNS)
docker network create --driver bridge appnet
# Run two containers on it; they resolve each other by name
docker run -d --name api --network appnet myapi:latest
docker run -d --name web --network appnet myweb:latest
# Inside 'web', 'ping api' works via built-in DNS
# Share the host stack (no isolation, native performance)
docker run -d --network host nginx:latest
# Fully disable networking
docker run --rm --network none alpine ip addrFollow-up Questions
- Why does the default bridge lack DNS while user-defined bridges have it?
- When would you choose macvlan over bridge networking?
- How does an overlay network encrypt traffic between hosts?
- What are the security implications of --network host?
- How does Docker publish container ports to the host?
MCQ Practice
1. Which built-in driver provides automatic DNS resolution between containers?
Only user-defined bridge networks offer built-in DNS so containers can reach each other by name; the default bridge does not.
2. Which driver spans multiple Docker hosts for clustered services?
The overlay driver connects containers across multiple hosts, which is how Swarm services communicate.
3. What does the 'host' network driver do?
Host mode removes network namespace isolation so the container uses the host's network stack directly.
Flash Cards
Name the built-in Docker network drivers — bridge, host, none, overlay, macvlan, and ipvlan.
Which bridge gives DNS name resolution? — User-defined bridges — the default docker0 bridge does not resolve container names.
What is the overlay driver for? — Connecting containers across multiple hosts, as in Docker Swarm clusters.
What does host mode sacrifice? — Network isolation — the container shares the host's stack for near-native performance.
What does macvlan provide? — A container with its own MAC address and IP directly on the physical LAN.