Docker Cookbook

3.4 Understanding Docker Container Networking | 77

---

3: docker0: mtu 1500 qdisc noqueue state UP ...
link/ether aa:85:e0:61:69:2d brd ff:ff:ff:ff:ff:ff promiscuity 0
bridge
7: veth450b81a: mtu 1500 qdisc pfifo_fast master docker0
link/ether aa:85:e0:61:69:2d brd ff:ff:ff:ff:ff:ff promiscuity 1
veth
$ brctl show
bridge name 
bridge id 
STP enabled 
interfaces
docker0
8000.aa85e061692d 
no 
veth450b81a
From the container, you can ping the network gateway 172.17.42.1 (i.e., 
docker0
),
other containers on the same host, and the outside world.
Start another container on a separate terminal and try to ping each
container. Verify that the second container interface is also attached
to the bridge. Since there are no IP table rules dropping traffic,
both containers can communicate with each other on any port.
Discussion
Outbound networking traffic is forwarded to the other interfaces of your Docker host
via IP forwarding and will go through NAT translation using an IP table masquerad‐
ing rule. On your Docker host you can check that IP forwarding has been enabled:
$ cat /proc/sys/net/ipv4/ip_forward
1
Try turning off IP forwarding, and you will see that your container
will lose outbound network connectivity:
# echo 0 > /proc/sys/net/ipv4/ip_forward
You can also check the NAT rule that does the IP masquerading for outbound traffic:
$ sudo iptables -t nat -L
...
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 172.17.42.0/24 anywhere
...
In 
Recipe 3.7
, you will see how to create this configuration from scratch.
See Also
• Docker official networking 
documentation