DevOps & Kubernetes (50 Qs)•Part 1: Candid Experience, Container Internals & Docker (1 - 10)
Docker Networking: Bridge vs. Host vs. Overlay networks and how port mapping works under the hood.
Direct Architecture Explanation
Docker provides several network drivers, each altering how the container interacts with the Linux network stack and host interfaces.
scss
1. Bridge Network (Default)
[ Host Interface eth0: 192.168.1.50 ]
|
[ iptables NAT ]
|
[ docker0 (veth pair): 172.17.0.1 ]
|
+----+----+
| |
[Cont A] [Cont B] (172.17.0.2, 172.17.0.3)
2. Host Network
[ Host eth0: 192.168.1.50 ] <--> [ Container shares host port directly ]
3. Overlay Network (Multi-Host)
[ Host 1 (Docker) ] <======= VXLAN Tunnel (UDP 4789) =======> [ Host 2 (Docker) ]
Network Driver Comparisons
| Network Mode | Command Flag | Mechanism & Use Case |
|---|---|---|
| Bridge | --network bridge | Creates a virtual bridge (docker0) on host. Each container gets a veth pair and private IP. Inter-container traffic routes through bridge; external traffic uses iptables NAT. |
| Host | --network host | Bypasses network namespace isolation. Container binds directly to host IP and ports. Offers maximum network throughput (zero NAT overhead) but eliminates port isolation. |
| None | --network none | Complete network isolation; only the loopback (127.0.0.1) interface exists. Used for batch cryptographic jobs or isolated security testing. |
| Overlay | --network overlay | Multi-host networking across swarm/cluster nodes using VXLAN encapsulation (UDP port 4789) to build a distributed flat L2 network. |
How Port Publishing (-p 8080:80) Works Under the Hood
- When running
docker run -p 8080:80 nginx, Docker creates an iptables DNAT (Destination NAT) rule in thePREROUTINGandDOCKERchains on the host. - Incoming packets to host port
8080have their destination IP and port rewritten to the container’s private bridge IP (e.g.172.17.0.2:80). - Return packets have their source address translated back via SNAT (Source NAT) through the host interface.