Marty ask Isn't the docker network segmented from the host slash public network. 1
A co-worker seems to think that the IP range in our Docker environment might cause a conflict with our 2
normal company network. 3
So that's actually a great question. 4
The answer to the first one is yes. 5
The Dockers. 6
So by default right you're using Docker network drivers and the default one is bridge. 7
If you're using swarm the default one is overlay and of course you can use other network drivers in 8
fact if you see me jump into into here and I just do a docker 9
network ls oh my Docker is not running 10
Oh and look at that there's a new version of Docker out No I do not want to update that today so give 11
me a minute for Docker to start. 12
But there is a there's a list of Docker network drivers that come out of the box and you choose the 13
default one bridge drive by just creating a docker network or not even specifying a network and don't 14
use bridge. 15
Most of us in production will use other networks like swarm overlay or Kubernetes will have its own 16
network drivers. 17
There are other ones like host and Mac v lan that you can use as well you can technically even use none 18
which will disable networking but the thing here is that if you're talking about the default bridge 19
network which again is probably not what you're going to use in production that is a net network segment 20
so it's its own subnet range and it's running in bridge mode so that means it's going to Nat itself 21
outside of that private subnet into your company networks. 22
But even though it won't technically conflict with your net physical networks you can't have the same 23
subnets that are used outside your host. 24
And that is due to just standard TCP IP routing. 25
So if you follow the the IP protocol routing details essentially if I'm on let's say a 10 0 0 0 subnet 26
on my docker container inside of Docker and then a 10 dot 0 1 subnet is used somewhere in my corporate 27
network then my container on my local machine won't know how to route to that network because it thinks 28
that that network is actually already a part of my local subnet. 29
Right. 30
So you can't technically have any subnet clashing anywhere in the hopping of containers around so even 31
though it technically Nats it's still going to probably cause issues and in fact with some companies 32
because the docker networks out of the box are usually 172 subnets and sometimes companies overlap those 33
subnets and that causes a problem which means that companies have to go into their Docker settings for 34
instance going up here into preferences and they would go into the daemon config and see sir I don't 35
think as a 7 that option yet 36
see that one day I saw one. 37
Oh so yeah. 38
So this is the default subnet right here. 39
It's a little hard to see maybe on the screen but it's a one entity 168 65 subnet and mine and you can 40
change that but you also may need to change other defaults inside the daemon config over here under 41
advanced based on whether using swarm overlay or using the default bridge and so on so forth. 42
So yes this is possible. 43
And basically if you're not sure just test create containers see if you can get maybe try to ping something 44
on your network the first way that usually people tell it this is a problem is they create containers 45
on our machine and then maybe have a sequel server or something in their data center or in a server 46
closet they need to get to. 47
So then they try to get from their container to that machine and they can't connect at all. 48
Give them some depending on you know the application and what you're using it might give you an error. 49
So try to ping try to do a trace route add those utilities into a container and see if you can trace 50
route or ping to that remote IP address because of course you if you're not someone who's managing all 51
the subnets in your company you may not know every subnet used all around the network. 52
Now another thing is that if you're using cloud like using Ada of U.S. subnets and your company maybe 53
houses part of their infrastructure there and you have VPN between you and eight of us then you also 54
have to care about the subnets in Ada U.S. and whether those will clash as well. 55
So basically Docker subnets even though they're needed aren't going to help you solve problems for getting 56
packets out any more than any other subnet on your network. 57
Basically you can't use it. 58
You should not and probably can't use two subnets the same anywhere in your network right. 59
It may it may allow you to get packets in because technically the packets coming in know how to get 60
to your machine because you're needed but when you try to send packets back out your machine might say 61
well hey I don't need the city's packets out because that particular IP address is in my local subnet 62
or at least it thinks it is. 63
Right. 64
So hope that makes sense. 65
That's just sort of some of the limitations of IP subheading and yes you may have to change that.