Chapter 10 of 16 · Visual guide

Networking: default bridge and veth pairs

The default bridge is a virtual switch on your host. Containers plug into it with virtual cables called veth pairs.

key idea / Docker itselfcontainer / good pathhost / watch outproblem / blockedneutral

The picture to remember

A packet from A to B

The big downside

See it yourself

On Linux. On Docker Desktop these live inside the Linux VM.

Try it yourself

1. Step 1 · Two containers on the default bridge

   Leaving off --network attaches them to bridge (docker0).

   $ docker run -d --name a --rm alpine:3.20 sleep 300
   $ docker run -d --name b --rm alpine:3.20 sleep 300
   $ docker inspect -f '{{.NetworkSettings.IPAddress}}' a
   172.17.0.2
   $ docker inspect -f '{{.NetworkSettings.IPAddress}}' b
   172.17.0.3

2. Step 2 · Ping the IP

   The bridge forwards that packet. The gateway 172.17.0.1 is docker0.

   $ docker exec b ping -c 1 172.17.0.2
   64 bytes from 172.17.0.2: seq=0 ttl=64 time=0.1 ms
   $ docker exec b apk add --no-cache iproute2
   $ docker exec b ip route
   default via 172.17.0.1 dev eth0

3. Step 3 · The name does not resolve

   $ docker exec b ping -c 1 a
   ping: bad address 'a'
   $ docker stop a b

Recap

• docker0 is a virtual switch; every container on the default bridge shares its subnet.
• A veth pair is a virtual cable: one end is the container eth0, the other plugs into the bridge.
• The bridge forwards by MAC address, so container-to-container traffic never leaves the host.
• The default bridge has no DNS, so containers can only find each other by IP.

Quick check