Docker networking is more than simply assigning an IP address to a container. Behind a simple command such as:

docker run -d -p 8080:80 nginx

Docker configures network namespaces, virtual interfaces, Linux bridges, IP addressing, routing, DNS, firewall rules, NAT, and port forwarding to create connectivity between the container, Docker host, and external networks.

This article explains Docker networking from the high-level architecture down to the Linux networking components and packet flow.

1. What Is Docker Network Architecture?

Docker network architecture is the combination of components and mechanisms that allow containers to communicate:

with other containers
with the Docker host
with external networks
with the Internet
across multiple Docker hosts when using supported multi-host networking

From a container's perspective, networking looks like a normal network stack: the container has a network interface, IP address, gateway, routing table, and DNS configuration. Docker manages the underlying implementation.

2. Docker Networking Architecture — High-Level View

On a Linux Docker host, the architecture can be visualized as:

3. Major Components of Docker Networking

A useful way to understand Docker networking is to break it into layers.

Layer	Component	Responsibility
1	Physical / Cloud NIC	Connects host to external network
2	Linux Network Namespace	Provides isolated network stack
3	Virtual Ethernet Pair	Connects container namespace to host networking
4	Linux Bridge	Connects containers on a bridge network
5	IPAM	Allocates container IP addresses
6	Routing	Determines where packets should go
7	DNS	Resolves container/service names
8	NAT / Masquerading	Provides external connectivity
9	Firewall Rules	Controls forwarding and published-port traffic
10	Network Driver	Defines how the Docker network is implemented

This layered model is particularly useful when troubleshooting connectivity.

4. Docker Network Drivers

Docker uses network drivers to implement different networking models.

Docker Networking
       │
       ├── bridge
       │
       ├── host
       │
       ├── none
       │
       ├── overlay
       │
       ├── macvlan
       │
       └── ipvlan

Bridge : The `bridge` driver is commonly used when containers running on the same Docker host need to communicate. Docker creates a default bridge network and also supports user-defined bridge networks.

Host : The container shares the host's networking namespace and does not receive a separate container IP address.

None : The container is isolated from normal host and container networking.

Overlay : Overlay networking creates a distributed network across multiple Docker daemon hosts and is commonly used with Docker Swarm.

Macvlan / IPvlan : These drivers can integrate containers more directly with external network addressing and Layer-2/Layer-3 networking requirements.

5. Docker Networking in a Real Application

                         Internet
                            │
                            ▼
                       Load Balancer
                            │
                            ▼
                       Web / Proxy
                            │
                     frontend-network
                            │
                            ▼
                           API
                            │
                     backend-network
                            │
              ┌─────────────┼─────────────┐
              ▼             ▼             ▼
           PostgreSQL      Redis        Kafka

What Happens When a Container Starts?

docker run -d \
  --name api \
  --network my-network \
  my-api

At a high level, Docker must establish the container's networking environment. The conceptual sequence is:

1. Create container
       ↓
2. Create / configure network namespace
       ↓
3. Connect container to requested Docker network
       ↓
4. Create virtual networking connection
       ↓
5. Attach container side to its network interface
       ↓
6. Attach host side to bridge/network
       ↓
7. Allocate IP address
       ↓
8. Configure gateway and routes
       ↓
9. Configure DNS
       ↓
10. Apply required networking/firewall rules
       ↓
11. Start application

Architecture Troubleshooting Model

When a container cannot communicate, don't immediately assume that Docker networking is broken.

Trace the architecture layer by layer:

Application
    ↓
Listening Port
    ↓
Container Network Interface
    ↓
Container IP
    ↓
Default Gateway / Route
    ↓
veth / Docker Network
    ↓
Docker Bridge
    ↓
Host Routing
    ↓
Firewall / NAT
    ↓
External Network

For example, if: curl http://api:8080 fails from the Web container, investigate:

1. Is API running?
2. Is API listening on 8080?
3. Are Web and API on the same network?
4. Does DNS resolve "api"?
5. Can Web reach API's IP?
6. Is the API bound to the correct interface?
7. Is a firewall rule blocking the traffic?

This is a much better troubleshooting approach than randomly changing ports or restarting containers.

Docker Network Inspection

docker network ls
docker network inspect my-network
docker inspect api
docker exec -it api ip addr

docker exec -it api ip route
docker exec -it api cat /etc/resolv.conf
docker exec -it api ping <target>

docker exec -it api curl http://web:80

Docker Network Architecture — Full Picture

                           INTERNET
                              │
                              │
                         Host eth0
                              │
                              ▼
                    ┌─────────────────┐
                    │   Docker Host   │
                    │                 │
                    │ Linux Network   │
                    │ Namespace       │
                    └────────┬────────┘
                             │
                     ┌───────▼────────┐
                     │ Docker Engine   │
                     │                 │
                     │ Network Driver  │
                     │ IPAM            │
                     │ DNS             │
                     │ Firewall/NAT    │
                     └───────┬────────┘
                             │
                     ┌───────▼────────┐
                     │ Docker Bridge   │
                     │   docker0       │
                     └───────┬────────┘
                             │
              ┌──────────────┼──────────────┐
              │              │              │
             veth           veth           veth
              │              │              │
       ┌──────▼──────┐ ┌─────▼──────┐ ┌─────▼──────┐
       │ Web Network │ │ API Network│ │ DB Network │
       │ Namespace   │ │ Namespace  │ │ Namespace  │
       │             │ │            │ │            │
       │ eth0        │ │ eth0       │ │ eth0       │
       │172.18.0.2   │ │172.18.0.3  │ │172.18.0.4  │
       └─────────────┘ └────────────┘ └────────────┘