networking • Advanced

Docker Networking: Bridge Networks, veth Pairs & iptables NAT

Docker connects containers using Virtual Ethernet (veth) cable pairs linked to a Linux software bridge (docker0 / custom bridge), routing incoming traffic via iptables PREROUTING NAT tables.

Intuitive Mental Model

The Ethernet Switch & Patch Cables: The host machine creates a virtual software network switch (docker0 bridge). Every container receives one end of a virtual ethernet patch cable (veth), while the other end is plugged into docker0.

Dockerfile / YAML Manifest / CLIProduction Standard

# Inspect Docker virtual network interfaces:
ip link show
# Shows: docker0 (bridge) <---> veth9a42f (container peer)

# Run container with port publishing:
docker run -d -p 8080:80 --name web nginx

# iptables NAT forwarding rule automatically created:
# -A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80

Key Architectural Takeaways

•veth pair: Virtual ethernet interface pair acting like a bidirectional patch cord between host network and container NET namespace.
•Bridge Driver: Default network providing private subnet (172.17.0.0/16) and automatic DNS resolution on user-defined custom networks.
•Host Driver: Bypasses container network isolation, binding directly to host network ports with zero NAT overhead.

Common Production Mistake

Trying to connect two containers via container names on the default "bridge" network (default bridge lacks embedded DNS).