Provide details and share your research But avoid Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

Not the answer youre looking for Browse other questions tagged docker docker-compose docker-networking or ask your own question.

They cover Docker, Kubernetes, and various steps along the way to effectively using them and Istio service mesh.

Ive been self-educating on the topic, and Im finding container networking a complex topic, with variations depending on the tools in use (Id like a scorecard summary).

For what its worth, some blogs Ive seen indicate that as use of containers grows and scales up, knowledge of container networking is becoming increasingly critical.

In the best case, they may ask for the networking teams design advice.

Im not prepared to write one, and if youre reading this, youre probably not looking for a blog that long.

For more info, please use the References listed at the end of this blog.

Ive often enough been in situations where server and hypervisor admins cant tell me whats going on in sufficient detail to troubleshoot a problem.

Most recently, forms of teaming in VMware mis-matched to a Nexus VPC.

How does user traffic reach containers How do various containerized micro-services reach each other.

The bridge is associated with a private IP subnet, and attached containers are automatically assigned addresses in that subnet.

The host that the containers are running on itself is also connected to the bridge.

All container ports on a user-defined bridge are accessible to the other attached containers.

By default, no container ports are exposed to the outside world.

Personally, I somewhat prefer servers to have exactly one network connection.

The concern is that servers should not be doing routing, as troubleshooting that is a nightmare.

Another concern is that back-end networks are implicit security, not explicit, so hard to audit.

That means it is publicly exposed same IP as the host, different ports.

A swarm provides declarative services, with scaling, state reconciliation, service discovery, load balancing, and other features.

Avoiding overlay encapsulation may help performance and appears to be one differentiating factor for service mesh tools (subject for a later blog).

You have to configure which host physical interface to use, also the subnet and default gateway.

This mode may be useful, for example, when switch port security is deployed, imposing a limit to how many different MAC addresses are seen on the physical switch port.

Container-mapped has a container sharing the IP, MAC, and networking of another container.

The publicly exposed ports can differ from the container port, with re-mapping done for you.

External-facing ports are not necessarily the same as the mapped internal ports.

Docker For Mac Networking Example