DockerLab

Chapter 9 of 16 · Visual guide

Networking: libnetwork and drivers

CNM is the blueprint. libnetwork is the engine that builds it, and drivers decide how the bits actually move.

key idea / Docker itselfcontainer / good pathhost / watch outproblem / blockedneutral

The networking stack

From docker CLI to the kernelThe CLI calls the daemon. The daemon uses libnetwork, which implements CNM and calls a driver. The driver configures the Linux kernel.docker CLIdocker run --network appDocker daemon (dockerd)libnetworkimplements the CNM: sandbox, endpoint, networkDrivers (plugins)bridgesingle hosthostno isolationoverlaymany hostsmacvlanown MACnullno networkLinux kernelnamespaces · veth · bridges · iptables · VXLAN
libnetwork is the layer that turns the CNM model into real interfaces and rules.

Choosing a driver

There are only a handful, and each answers one question.

Which driver do I need?Where do the containers run?bridgedefault, localhostno isolationmacvlanown LAN IPoverlaymany hostsnoneloopback only
Start at bridge. Move right only when you have a reason.
DriverScopeContainer getsUse it when
bridgelocalprivate IP behind NATthe default for one machine
hostlocalthe host's own stackyou need raw speed and accept no isolation
overlayswarmIP on a virtual multi-host networkcontainers on different hosts must talk
macvlanlocalits own MAC and LAN IPit must look like a real machine on the LAN
nonelocalonly loopbackfull network isolation

Pluggable

Pluggable by designlibnetwork talks to every driver through the same interface. Built-in drivers and third-party plugins plug into it the same way.libnetworkone driver interfacedriver APIBuilt-in driversbridge · host · overlay · macvlan · nullThird-party network pluginsinstalled separately, same interface

Try it yourself

  1. Step 1 · List networks and their drivers 
    $ docker network ls
NETWORK ID     NAME      DRIVER    SCOPE
a1b2c3d4e5f6   bridge    bridge    local
b2c3d4e5f6a1   host      host      local
c3d4e5f6a1b2   none      null      local
  2. Step 2 · Read the driver from inspect 
    $ docker network inspect bridge --format '{{.Driver}} {{.Scope}}'
bridge local
  3. Step 3 · Create a bridge, then remove it

    --driver bridge asks libnetwork for the built-in bridge driver. rm fails if a container is still attached.

    $ docker network create --driver bridge app
$ docker network ls --filter name=app
NETWORK ID     NAME   DRIVER   SCOPE
d4e5f6a1b2c3   app    bridge   local
$ docker network rm app
app

Recap

Quick check

In an interview: "How does Docker networking work?" What is a better answer than "it uses a bridge"?
Show answer

Describe the layers: the CNM model (sandbox, endpoint, network) implemented by libnetwork, which calls a driver such as bridge to create veth pairs, bridges and iptables rules in the kernel.