DockerLab

Chapter 14 of 16 · Visual guide

Networking: host, none, and MacVLAN/IPVLAN

Bridge is the default. These four modes change how much private network a container gets, from all of it to none of it.

key idea / Docker itselfcontainer / good pathhost / watch outproblem / blockedneutral

Four modes at a glance

Four network modes at a glanceBridge gives a private namespace behind NAT. Host shares the host network stack. None gives only loopback. Macvlan gives the container its own MAC address on the LAN.--network bridgeContainerprivate stack--network hostContainerhost stack--network noneContainerloopback only--network macvlanContainerown MACveth + NATsame stackno networkown MAC + IPHost network (eth0, LAN)host mode is not a cable to the host network: the container is in the host namespace.
The further right you go, the more the container behaves like a real machine, or like no machine at all.
ModeUse it whenCost
bridgealmost alwaysone NAT hop
hostyou need peak network performanceno isolation, shared ports
nonethe job must never touch a networkno connectivity at all
macvlanthe container must appear as its own deviceneeds LAN cooperation

host: no isolation on purpose

host mode shares the port tableIn host mode the process binds a port on the host itself. Two host-mode containers cannot both use port 80.Host namespacenginx container--network hostport 80 on the hosttaken by nginxsecond nginxport 80 in useThere is only one :80 on the host.
host mode removes the NAT hop and the isolation in the same move.

macvlan and ipvlan

macvlan: a container on your LANThe container has its own MAC and an address in the LAN subnet, so other machines see it as a separate device.Router 192.168.1.1LAN 192.168.1.0/24Laptop192.168.1.30Docker hosteth0 192.168.1.20Containerown MAC · 192.168.1.50the container sits next to the host on the LAN, not behind it
macvlan needs a network that accepts extra MAC addresses. Many Wi-Fi access points drop them.
macvlanipvlan
MAC addressa new MAC per containershares the parent's MAC
Switch needsto allow several MACs per portnothing special
Wi-Fi interfacesoften droppedusually works
Use it whena legacy app needs its own LAN identitythe network limits MACs per port

Try it yourself

On Docker Desktop, --network host shares the Linux VM’s network, not the Mac’s interfaces.

  1. Step 1 · none has only loopback 
    $ docker run --rm --network none alpine:3.20 ping -c 1 1.1.1.1
ping: bad address '1.1.1.1'
$ docker run --rm --network none alpine:3.20 cat /etc/hosts
127.0.0.1  localhost
  2. Step 2 · host has no separate container address

    There is no eth0 in a private namespace. A published -p is unnecessary because the process binds the host stack directly.

    $ docker run --rm --network host alpine:3.20 cat /etc/hosts
# this file is the VM or host hosts file, not a private one
  3. Step 3 · macvlan asks for a parent interface

    Replace eth0 with a real interface on a Linux host. This fails on a laptop Wi-Fi interface that drops extra MAC addresses, which is the point of the check.

    $ docker network create -d macvlan \
  --subnet=192.168.1.0/24 \
  --gateway=192.168.1.1 \
  -o parent=eth0 lan
$ docker network inspect lan --format '{{.Driver}} {{.Options.parent}}'
macvlan eth0

Recap

Quick check

Why does a second container with --network host fail to start nginx on port 80?
Show answer

Both containers are in the host namespace, so they share one port table. The first nginx already owns :80.