Bridge Networking

In one sentence: The default network driver is a virtual Ethernet switch (a bridge) on the host, with each container plugged in via a veth pair — a virtual cable whose ends sit in different namespaces.

A switch and some cables

The bridge driver builds physical-network topology from virtual parts. The bridge is a software Ethernet switch living on the host. A veth pair is two interfaces acting as one cable: bytes in one end exit the other, even across namespace boundaries. For each container the driver creates a pair, pushes one end into the sandbox (renamed eth0, given an IP from the network's subnet), and plugs the other end into the bridge. Container-to-container traffic is then ordinary switching: A → cable → bridge → cable → B, never touching the host's physical NIC. Outbound traffic to the internet takes one extra hop — the host routes it out with source NAT, rewriting the private container IP to the host's own.

flowchart TB
  subgraph HOST["host network namespace"]
    BR["bridge mdock0
172.18.0.1/16 (software switch)"]
    VA["veth-a (cable end)"]
    VB["veth-b (cable end)"]
    NIC["physical NIC
(host IP 203.0.113.7)"]
    BR --- VA
    BR --- VB
    BR -- "outbound only:
source NAT" --> NIC
  end
  subgraph SA["sandbox: container A"]
    EA["eth0 172.18.0.2"]
  end
  subgraph SB["sandbox: container B"]
    EB["eth0 172.18.0.3"]
  end
  EA === VA
  EB === VB
    

sequenceDiagram
  participant A as A's eth0 (172.18.0.2)
  participant BR as bridge mdock0
  participant B as B's eth0 (172.18.0.3)
  A->>BR: packet dst 172.18.0.3 (via veth cable)
  BR->>BR: switch lookup: which port owns that address?
  BR->>B: forward out B's veth port
  note over A,B: pure layer-2 switching —
the physical NIC never sees this packet