Docker Series — Part 6: Docker Networking, IP Management, NATing & SDN Explained

Welcome to Part 6 of the Docker: Basics to Advance series.
In this post, we’ll uncover how networking works inside Docker, how containers get their IP addresses, how they connect to the outside world, and how Docker leverages Software Defined Networking (SDN) to simulate real-world infrastructure.

How Networking Works in Docker

When you launch a Docker container, Docker automatically:

• Assigns a unique IP address to the container

• Attaches it to a bridge network by default

• Enables the container to ping the internet

For example:

ping google.com

• Works inside the container

• But the container can’t be pinged from outside the host unless we expose ports.

This is because containers are isolated by default — like mini-sandboxes.

---

Public vs Private IP: Why NAT Matters

Every container gets a private IP like 172.17.x.x.

Let’s understand:

• Private IP ↔ Private IP = Works

• Public IP ↔ Public IP = Works

• Private IP ↛ Public IP = Doesn’t work directly

To allow this communication, we use a concept called NAT (Network Address Translation) — Docker handles this internally.

---

NATing and IP Masquerading

When a container connects to the internet:

• The router replaces the source IP (private) with the host's public IP

• This is called masquerading

Docker handles this using built-in rules:

"com.docker.network.bridge.enable_ip_masquerade": "true"

When set to true, outgoing traffic from a container to the outside world (e.g., internet or other networks) will appear as if it’s coming from the host machine, not from the container’s internal IP.

---

Inspecting Docker’s Networking Internals

List Docker Networks:

docker network ls

Output:

NETWORK ID     NAME      DRIVER    SCOPE
f36b89169326   bridge    bridge    local
cdbfd4363b7d   host      host      local
02b9ef3299a    none      null      local

• bridge is the default Docker network

• host uses the host's networking

• none gives complete isolation

Inspect a Specific Network:

docker network inspect bridge

This shows:

• Network name

• Subnet range

• Gateway IP

• Attached container info (IP, MAC address)

---

Launch a Container in a Specific Network

By default, Docker uses the bridge network. But you can specify a custom one:

docker run -dit --name mycontainer --network bridge ubuntu

Inspect the container to confirm:

docker inspect mycontainer

You’ll find:

• "IPAddress": "172.17.0.X"

• "Gateway": "172.17.0.1"

• "NetworkID" and "MacAddress"

---

What is Software Defined Networking (SDN)?

SDN allows Docker to:

• Create virtual switches and routers

• Assign IP addresses automatically

• Simulate networking behaviour just like physical infrastructure

This is how Docker builds its internal network architecture — all software-defined, fast, and portable.

---

Key Docker Networking Concepts

---

Recap

In this post, you learned:

• How Docker assigns container IPs

• The difference between public and private IP

• What NAT and masquerading mean in Docker

• How Docker internally simulates networking using SDN

• How to inspect and manage Docker networks

---

Have questions about Docker networking or confused about bridge vs host vs overlay?
Drop a comment or DM — happy to help!

#Docker #DevOps #Networking #ContainerNetworking #NAT #SDN #DockerSeries #IPAM #CloudNative #Linux #BridgeNetwork #Hashnode