Trace the complete path of a network packet from a user's browser to a process inside a Docker container running on a Linux host. What happens at each layer?
Quick Answer
Packet arrives at host NIC → kernel network stack (iptables PREROUTING) → DNAT to container IP → bridge (docker0) → veth pair → container network namespace → application socket.
Detailed Answer
Complete Packet Path
1. NIC receives frame: Hardware NIC receives Ethernet frame, DMA copies to ring buffer in kernel memory, raises IRQ
2. Kernel softirq processing: NAPI polls the ring buffer, creates sk_buff structure, passes up the stack
3. IP layer: Kernel checks destination IP. If it's the host IP with a mapped port, continues processing.
4. Netfilter/iptables PREROUTING: Docker's DNAT rule matches: `` -A DOCKER -p tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80 ` Packet destination is rewritten from host_ip:8080 to container_ip:80`
5. Routing decision: Kernel routing table sees destination 172.17.0.0/16 → route via docker0 bridge
6. Bridge forwarding: docker0 Linux bridge looks up MAC address for 172.17.0.2 in its FDB (forwarding database), forwards frame to the correct veth interface
7. veth pair: Packet enters vethXXX (host side), appears on eth0 (container side). veth pairs act as a virtual ethernet cable between namespaces.
8. Container network namespace: Packet arrives in the container's isolated network namespace with its own routing table, IP address, and iptables rules
9. TCP/IP processing in container: Kernel (shared kernel, different namespace) delivers to the listening socket
10. Application reads from socket: accept() → read() → application processes the HTTP request
Return path: Response goes back through the same chain in reverse, with SNAT (MASQUERADE) rewriting the source address on outbound.
Key Concepts
- Network namespaces: Isolated network stacks (interfaces, routes, iptables) - veth pairs: Virtual ethernet pipe connecting two namespaces - Linux bridge: Software L2 switch - Conntrack: Tracks connection state for NAT translation of return packets
Code Example
# Trace the path yourself:
# 1. See the bridge and veth interfaces
ip link show type bridge
brctl show docker0
# 2. See iptables NAT rules Docker creates
iptables -t nat -L DOCKER -n -v
# 3. See routing table
ip route show
# 4. Find which veth connects to which container
NS_PID=$(docker inspect --format '{{.State.Pid}}' <container>)
nsenter -t $NS_PID -n ip link show eth0
# The ifindex peer tells you which veth on the host
# 5. Capture packets at each hop
tcpdump -i eth0 port 8080 -nn # Host NIC
tcpdump -i docker0 port 80 -nn # Bridge
tcpdump -i vethXXX port 80 -nn # veth to containerInterview Tip
Walk through each layer methodically — NIC → kernel → iptables → bridge → veth → namespace → socket. This is the quintessential 'do you actually understand networking or just use abstractions' question at Google and Meta.