Network Types
| Type | Scope | Use case |
|---|---|---|
bridge | Single host | Default network for containers on one node. The docker0 interface. |
overlay | Multi-host (Swarm) | Connects containers across different physical nodes. Encrypted tunnel between nodes. |
docker_gwbridge | Single host | Connects the overlay network to the host's physical network. |
host | Single host | Container shares the host's network stack directly (no isolation). |
The docker0 Bridge
The docker0 bridge is a virtual interface created automatically by Docker. It picks a private IP subnet from RFC 1918 and assigns it to docker0. All containers on the same host join this bridge by default and can communicate via NAT with the outside world.
Overlay Networks in Swarm
When you deploy a stack, Docker automatically creates an overlay network that spans all Swarm nodes. Containers on different physical Pis communicate as if they were on the same LAN — the overlay encapsulates traffic in VXLAN tunnels over your real Ethernet network.
Inspect Networks on MASTER
List all Docker networks
$ docker network ls
NETWORK ID NAME DRIVER SCOPE
abc123def456 bridge bridge local
ghi789jkl012 docker_gwbridge bridge local
mno345pqr678 host host local
qrs901tuv234 ingress overlay swarm
wxy567zab890 jlar_overlay overlay swarmView Network Interfaces with ifconfig
Network interfaces on MASTER
$ ifconfig
docker0: inet 172.17.0.1 (default bridge)
docker_gwbridge: inet 172.18.0.1 (overlay gateway)
br-31710a035769: inet 172.21.0.1 (stack overlay bridge)
eth0: inet 192.168.0.23 (physical LAN)Overlay Visualiser
To visualise overlay networks graphically, you can deploy a Swarm Overlay Visualiser:
github.com/marcelbrouwers/swarmoverlayvisualizer
Do NOT install a conventional Linux firewall (ufw, iptables) on a Docker host. Docker uses Netfilter iptables internally for overlay networking. A firewall will conflict with Docker's rules and can silently break container networking — or destroy the Docker installation entirely.
Official docs: Docker overlay filesystem driver