How does Docker networking work internally? Explain bridge, host, and overlay networks, and when you would use each.
Quick Answer
Bridge uses Linux bridges and veth pairs for single-host container networking. Host shares the host network namespace. Overlay uses VXLAN tunneling for multi-host networking in Swarm/Kubernetes.
Detailed Answer
Bridge Network (default)
- Docker creates a Linux bridge (docker0) on the host - Each container gets a veth pair: one end in the container namespace, one attached to the bridge - Containers on the same bridge can communicate via IP - NAT (iptables MASQUERADE) enables outbound internet access - Port mapping (-p 8080:80) uses iptables DNAT rules - Use when: Single-host deployments, development, isolated service groups
Host Network
- Container shares the host's network namespace entirely - No network isolation — container binds directly to host ports - No NAT overhead — best raw network performance - Use when: Performance-critical workloads (monitoring agents, load balancers), or when you need to bind to specific host interfaces - Risk: Port conflicts between containers, no network isolation
Overlay Network
- Creates a distributed network across multiple Docker hosts - Uses VXLAN (Virtual Extensible LAN) to encapsulate L2 frames in UDP packets - Each host gets a VTEP (VXLAN Tunnel Endpoint) - Control plane uses gossip protocol (Serf) for membership and libkv for state - Use when: Docker Swarm multi-host deployments, cross-host service discovery - Kubernetes equivalent: CNI plugins (Calico, Cilium, Flannel) replace Docker overlay
Macvlan Network
- Assigns a real MAC address to each container - Container appears as a physical device on the network - No bridge, no NAT — direct L2 connectivity - Use when: Legacy apps that need to be on the physical network, DHCP requirements
Performance Comparison
- Host: ~0% overhead (native) - Macvlan: ~1-2% overhead - Bridge: ~5-10% overhead (NAT + bridge) - Overlay: ~10-20% overhead (VXLAN encapsulation)
Code Example
# Create user-defined bridge (recommended over default) docker network create --driver bridge my-app-network # Run containers on the same network (DNS resolution by name) docker run -d --name api --network my-app-network api:latest docker run -d --name db --network my-app-network postgres:15 # api can reach db at hostname 'db' # Host networking docker run -d --network host nginx:latest # Overlay (requires Swarm) docker network create --driver overlay --attachable my-overlay # Inspect network internals docker network inspect my-app-network # Check veth pairs ip link show type veth # Check iptables NAT rules iptables -t nat -L -n | grep DOCKER
Interview Tip
Explain the Linux primitives underneath — veth pairs, bridges, iptables, VXLAN. This shows you understand networking fundamentals, not just Docker abstractions. Include performance numbers to demonstrate production experience.