Docker networking: CNM, drivers, and Swarm networks

Container Network Model (CNM)

Docker networking is based on the Container Network Model (CNM) specification. CNM defines three building blocks:

• Sandboxes — isolate the network stack (interfaces, ports, routing tables).
• Endpoints — virtual network interfaces that connect a sandbox to a network.
• Networks — connect endpoints together.

libnetwork is the practical CNM implementation. Drivers extend the model with different topologies.

Network drivers

• bridge — default driver on Linux.
• host — use the host network namespace.
• overlay — multi-host network for distributed Docker hosts (for example in Swarm).
• macvlan — assign a MAC address so the container looks like a physical device on the LAN.
• none — disable networking.
• Network plugins — third-party drivers.

Files managed inside the container

Docker always manages these files inside a container:

/etc/hosts
/etc/hostname
/etc/resolv.conf

Swarm mode

In Swarm mode, Docker creates a default ingress network with the overlay driver.

It also creates a bridge network docker_gwbridge that connects Swarm node daemons.

Related topics

• Connecting containers — legacy --link and container communication
• Exposing containers — publish ports to the host
• Swarm — cluster networking and services
• Service discovery — etcd, Consul, DNS-based discovery