Container Networking Cheat Sheet

Updated 2026-05-25

Next Topic: Container Orchestration Patterns Cheat Sheet

Container networking enables communication between containers, with external services, and across multiple hosts. In Docker, networking is implemented through pluggable drivers (bridge, overlay, host, macvlan, ipvlan, none), each serving different use cases from single-host isolation to multi-host orchestration. Kubernetes extends this with its own flat networking model requiring all pods to communicate without NAT, managed through CNI (Container Network Interface) plugins that provide the actual network implementation. Newer runtimes like Podman 4+ use their own stack (Netavark + Aardvark-DNS), while containerd-based tools like nerdctl also rely on CNI plugins. Understanding container networking is essential because network isolation, DNS resolution, service discovery, and load balancing are fundamental to microservices architectures — without proper networking configuration, containers remain isolated islands unable to collaborate as distributed systems.

What This Cheat Sheet Covers

This topic spans 13 focused tables and 165 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Network DriversTable 2: Network Modes and CharacteristicsTable 3: Network Creation and ConfigurationTable 4: Container Network AttachmentTable 5: DNS and Service DiscoveryTable 6: Port Mapping and PublishingTable 7: Network Isolation and SecurityTable 8: IP Address Management (IPAM)Table 9: Multi-Host NetworkingTable 10: CNI Plugins and StandardsTable 11: Network Troubleshooting and InspectionTable 12: Advanced Networking FeaturesTable 13: Podman Networking

Table 1: Network Drivers

Docker's pluggable network driver model allows different networking strategies for different workloads. The driver is selected at network creation time and determines how containers communicate within and across hosts.

Driver	Example	Description
bridge	`docker network create -d bridge my-net`	• Default Docker network driver creating an isolated network on a single host • containers on the same bridge can communicate; external access requires port publishing • uses Linux bridge (`docker0` by default) • user-defined bridges add automatic DNS resolution between containers.
overlay	`docker network create -d overlay` `--attachable multi-host-net`	• Enables multi-host container communication via VXLAN tunneling over UDP port 4789 • requires Swarm mode even for standalone containers • control plane traffic always encrypted; data plane optionally encrypted.
host	`docker run --network host nginx`	• Removes network isolation — container shares host's network namespace directly • highest performance but no port isolation; `-p` flags are ignored • Linux-only; not available on Docker Desktop (Mac/Windows).

Table 1: Network Drivers

Driver	Example	Description
bridge	`docker network create -d bridge my-net`	• Default Docker network driver creating an isolated network on a single host • containers on the same bridge can communicate; external access requires port publishing • uses Linux bridge (`docker0` by default) • user-defined bridges add automatic DNS resolution between containers.
overlay	`docker network create -d overlay` `--attachable multi-host-net`	• Enables multi-host container communication via VXLAN tunneling over UDP port 4789 • requires Swarm mode even for standalone containers • control plane traffic always encrypted; data plane optionally encrypted.
host	`docker run --network host nginx`	• Removes network isolation — container shares host's network namespace directly • highest performance but no port isolation; `-p` flags are ignored • Linux-only; not available on Docker Desktop (Mac/Windows).