Docker networking is CRAZY!! (you NEED to learn it)

About this video

This is a hands-on lab tour of the seven Docker network types, run on an Ubuntu desktop VM in VirtualBox switched to a bridged adapter. It starts with the default bridge: installing Docker creates the docker0 virtual bridge, containers get virtual Ethernet interfaces linked to it, receive addresses in its subnet, share the host’s DNS, can reach each other and the internet via NAT, but their services are unreachable from outside unless a port is explicitly published with -p, as shown by redeploying an Nginx container with port 80 exposed. Next is the user-defined bridge, created with one docker network create command: it works like the default bridge but isolates its containers from the default network and adds container-name DNS resolution, which the creator says is why Docker recommends creating your own networks. The host network removes isolation entirely — the container shares the host IP and ports and needs no publishing, illustrated as useful for something like a WireGuard VPN container. MacVLAN puts containers directly on the physical LAN with their own MAC and IP addresses so no port publishing is needed, but it requires promiscuous mode on the host interface and hypervisor, and has no real DHCP, so addresses should be assigned manually to avoid conflicts; an 802.1Q mode can create VLAN sub-interfaces. IPVLAN L2 keeps the direct-on-LAN benefit while sharing the host’s MAC address, avoiding the promiscuous-mode problem. IPVLAN L3 turns the host into a router for entirely new container subnets with no broadcast or ARP, reachable only after adding static routes on the home router. The video briefly notes overlay networks for multi-host Docker Swarm and finishes with the none network, which gives a container only loopback for maximum isolation.

Key takeaways

• Default bridge containers can talk to each other and out to the internet, but inbound access requires explicitly publishing ports — that isolation is intentional
• Prefer user-defined bridges in practice: they isolate workloads from the default network and let containers resolve each other by name
• Host networking is simplest and needs no port mapping, but offers no isolation; MacVLAN gives containers real LAN IPs and MACs at the cost of promiscuous mode and manual IP management
• IPVLAN L2 fixes MacVLAN’s main pain by sharing the host MAC, while IPVLAN L3 makes the host a router for new routed subnets — powerful, but you must add static routes for outside reachability
• Overlay is for multi-host Swarm setups, and the none network (loopback only) is the most locked-down option; knowing which driver fits is itself a resume-worthy lab skill

Episode details: published August 6, 2022 · 39:12 long. Summary written by Self Growth Videos from the episode itself. Business results and any income figures mentioned are NetworkChuck’s own claims, shared for education — they are not typical or guaranteed.

← Previous: find HIDDEN urls!! (subdomain enumeration hacking) // ft. HakLuke · Next: HACK your way into a job (no experience required) →

All NetworkChuck videos · NetworkChuck profile · NetworkChuck on YouTube