‫Marty ask Isn't the docker network segmented from the host slash public network.
‫A co-worker seems to think that the IP range in our Docker environment might cause a conflict with our
‫normal company network.
‫So that's actually a great question.
‫The answer to the first one is yes.
‫The Dockers.
‫So by default right you're using Docker network drivers and the default one is bridge.
‫If you're using swarm the default one is overlay and of course you can use other network drivers in
‫fact if you see me jump into into here and I just do a docker
‫network ls oh my Docker is not running
‫Oh and look at that there's a new version of Docker out No I do not want to update that today so give
‫me a minute for Docker to start.
‫But there is a there's a list of Docker network drivers that come out of the box and you choose the
‫default one bridge drive by just creating a docker network or not even specifying a network and don't
‫use bridge.
‫Most of us in production will use other networks like swarm overlay or Kubernetes will have its own
‫network drivers.
‫There are other ones like host and Mac v lan that you can use as well you can technically even use none
‫which will disable networking but the thing here is that if you're talking about the default bridge
‫network which again is probably not what you're going to use in production that is a net network segment
‫so it's its own subnet range and it's running in bridge mode so that means it's going to Nat itself
‫outside of that private subnet into your company networks.
‫But even though it won't technically conflict with your net physical networks you can't have the same
‫subnets that are used outside your host.
‫And that is due to just standard TCP IP routing.
‫So if you follow the the IP protocol routing details essentially if I'm on let's say a 10 0 0 0 subnet
‫on my docker container inside of Docker and then a 10 dot 0 1 subnet is used somewhere in my corporate
‫network then my container on my local machine won't know how to route to that network because it thinks
‫that that network is actually already a part of my local subnet.
‫Right.
‫So you can't technically have any subnet clashing anywhere in the hopping of containers around so even
‫though it technically Nats it's still going to probably cause issues and in fact with some companies
‫because the docker networks out of the box are usually 172 subnets and sometimes companies overlap those
‫subnets and that causes a problem which means that companies have to go into their Docker settings for
‫instance going up here into preferences and they would go into the daemon config and see sir I don't
‫think as a 7 that option yet
‫see that one day I saw one.
‫Oh so yeah.
‫So this is the default subnet right here.
‫It's a little hard to see maybe on the screen but it's a one entity 168 65 subnet and mine and you can
‫change that but you also may need to change other defaults inside the daemon config over here under
‫advanced based on whether using swarm overlay or using the default bridge and so on so forth.
‫So yes this is possible.
‫And basically if you're not sure just test create containers see if you can get maybe try to ping something
‫on your network the first way that usually people tell it this is a problem is they create containers
‫on our machine and then maybe have a sequel server or something in their data center or in a server
‫closet they need to get to.
‫So then they try to get from their container to that machine and they can't connect at all.
‫Give them some depending on you know the application and what you're using it might give you an error.
‫So try to ping try to do a trace route add those utilities into a container and see if you can trace
‫route or ping to that remote IP address because of course you if you're not someone who's managing all
‫the subnets in your company you may not know every subnet used all around the network.
‫Now another thing is that if you're using cloud like using Ada of U.S. subnets and your company maybe
‫houses part of their infrastructure there and you have VPN between you and eight of us then you also
‫have to care about the subnets in Ada U.S. and whether those will clash as well.
‫So basically Docker subnets even though they're needed aren't going to help you solve problems for getting
‫packets out any more than any other subnet on your network.
‫Basically you can't use it.
‫You should not and probably can't use two subnets the same anywhere in your network right.
‫It may it may allow you to get packets in because technically the packets coming in know how to get
‫to your machine because you're needed but when you try to send packets back out your machine might say
‫well hey I don't need the city's packets out because that particular IP address is in my local subnet
‫or at least it thinks it is.
‫Right.
‫So hope that makes sense.
‫That's just sort of some of the limitations of IP subheading and yes you may have to change that.