Container Networking Cheat Sheet

Updated 2026-05-25

Next Topic: Container Orchestration Patterns Cheat Sheet

🧠Study flashcards on this topic112 cards · spaced repetition→

Container networking enables communication between containers, with external services, and across multiple hosts. In Docker, networking is implemented through pluggable drivers (bridge, overlay, host, macvlan, ipvlan, none), each serving different use cases from single-host isolation to multi-host orchestration. Kubernetes extends this with its own flat networking model requiring all pods to communicate without NAT, managed through CNI (Container Network Interface) plugins that provide the actual network implementation. Newer runtimes like Podman 4+ use their own stack (Netavark + Aardvark-DNS), while containerd-based tools like nerdctl also rely on CNI plugins. Understanding container networking is essential because network isolation, DNS resolution, service discovery, and load balancing are fundamental to microservices architectures — without proper networking configuration, containers remain isolated islands unable to collaborate as distributed systems.

What This Cheat Sheet Covers

This topic spans 13 focused tables and 165 indexed concepts, 112 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Network DriversTable 2: Network Modes and CharacteristicsTable 3: Network Creation and ConfigurationTable 4: Container Network AttachmentTable 5: DNS and Service DiscoveryTable 6: Port Mapping and PublishingTable 7: Network Isolation and SecurityTable 8: IP Address Management (IPAM)Table 9: Multi-Host NetworkingTable 10: CNI Plugins and StandardsTable 11: Network Troubleshooting and InspectionTable 12: Advanced Networking FeaturesTable 13: Podman Networking

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Network Drivers

Docker's pluggable network driver model allows different networking strategies for different workloads. The driver is selected at network creation time and determines how containers communicate within and across hosts.

Driver	Example	Description
bridge	`docker network create -d bridge my-net`	• Default Docker network driver creating an isolated network on a single host • containers on the same bridge can communicate; external access requires port publishing • uses Linux bridge (`docker0` by default) • user-defined bridges add automatic DNS resolution between containers.
overlay	`docker network create -d overlay` `--attachable multi-host-net`	• Enables multi-host container communication via VXLAN tunneling over UDP port 4789 • requires Swarm mode even for standalone containers • control plane traffic always encrypted; data plane optionally encrypted.
host	`docker run --network host nginx`	• Removes network isolation — container shares host's network namespace directly • highest performance but no port isolation; `-p` flags are ignored • Linux-only; not available on Docker Desktop (Mac/Windows).
macvlan	`docker network create -d macvlan` `-o parent=eth0 macvlan-net`	• Assigns a unique MAC address to each container, making it appear as a physical device on the network • requires promiscuous mode on the physical interface • useful for legacy apps expecting direct L2 connectivity • containers cannot communicate with the host directly.
ipvlan	`docker network create -d ipvlan` `-o ipvlan_mode=l2 ipvlan-net`	• Similar to macvlan but all containers share the parent interface's MAC address • supports L2 (layer 2) and L3 (layer 3 routing) modes • reduces MAC table pressure on switches • blocks broadcast/multicast in L3 mode.
none	`docker run --network none alpine`	• Complete network isolation — container has only a loopback interface, no external connectivity • used for maximum security isolation or when custom networking will be configured manually via exec.

Table 2: Network Modes and Characteristics

Network modes describe how a container's network namespace is configured and how it relates to the host and other containers. Choosing the right mode is the first decision in container network design.

Mode	Example	Description
Bridge mode (default)	`docker run --network bridge nginx`	• Containers connect to `docker0` bridge • communication by IP only unless using legacy `--link` • default for standalone containers • user-defined bridges provide automatic DNS and better isolation.

The rest of this section is part of the full cheat sheet

Table 3: Network Creation and Configuration

Docker's docker network command family manages the lifecycle of networks. These commands apply to all driver types and provide fine-grained control over IP allocation, isolation, and driver-specific tuning.

Command	Example	Description
docker network create	`docker network create my-net`	• Creates a new user-defined network (bridge by default) • returns network ID • network persists until explicitly removed with `docker network rm`.

The rest of this section is part of the full cheat sheet

Table 4: Container Network Attachment

Beyond creating networks, containers must be attached to them at runtime or dynamically. These commands and flags control which networks a container participates in and how it is addressed on each network.

Command	Example	Description
--network	`docker run --network my-net nginx`	• Connects container to specified network at creation • can specify multiple `--network` flags to attach to multiple networks simultaneously • default is `bridge` if omitted.

The rest of this section is part of the full cheat sheet

Table 1: Network Drivers

Driver	Example	Description
bridge	`docker network create -d bridge my-net`	• Default Docker network driver creating an isolated network on a single host • containers on the same bridge can communicate; external access requires port publishing • uses Linux bridge (`docker0` by default) • user-defined bridges add automatic DNS resolution between containers.
overlay	`docker network create -d overlay` `--attachable multi-host-net`	• Enables multi-host container communication via VXLAN tunneling over UDP port 4789 • requires Swarm mode even for standalone containers • control plane traffic always encrypted; data plane optionally encrypted.
host	`docker run --network host nginx`	• Removes network isolation — container shares host's network namespace directly • highest performance but no port isolation; `-p` flags are ignored • Linux-only; not available on Docker Desktop (Mac/Windows).
macvlan	`docker network create -d macvlan` `-o parent=eth0 macvlan-net`	• Assigns a unique MAC address to each container, making it appear as a physical device on the network • requires promiscuous mode on the physical interface • useful for legacy apps expecting direct L2 connectivity • containers cannot communicate with the host directly.
ipvlan	`docker network create -d ipvlan` `-o ipvlan_mode=l2 ipvlan-net`	• Similar to macvlan but all containers share the parent interface's MAC address • supports L2 (layer 2) and L3 (layer 3 routing) modes • reduces MAC table pressure on switches • blocks broadcast/multicast in L3 mode.
none	`docker run --network none alpine`	• Complete network isolation — container has only a loopback interface, no external connectivity • used for maximum security isolation or when custom networking will be configured manually via exec.

Table 2: Network Modes and Characteristics

Mode	Example	Description
Bridge mode (default)	`docker run --network bridge nginx`	• Containers connect to `docker0` bridge • communication by IP only unless using legacy `--link` • default for standalone containers • user-defined bridges provide automatic DNS and better isolation.

Table 3: Network Creation and Configuration

Command	Example	Description
docker network create	`docker network create my-net`	• Creates a new user-defined network (bridge by default) • returns network ID • network persists until explicitly removed with `docker network rm`.

Table 4: Container Network Attachment

Command	Example	Description
--network	`docker run --network my-net nginx`	• Connects container to specified network at creation • can specify multiple `--network` flags to attach to multiple networks simultaneously • default is `bridge` if omitted.