What are Docker's built-in network drivers?
Quick Answer
bridge (the default) creates a private, isolated virtual network on the host, with NAT to reach the outside world. host removes network isolation, sharing the host's own network namespace directly. none gives a container no networking beyond loopback. overlay connects containers across multiple Docker hosts, used in Swarm mode. macvlan gives a container its own MAC address, so it looks like a physical device on the host's network. Most single-host setups use bridge networking, usually a custom user-defined bridge rather than the default one.
Detailed Answer
bridge — the default, isolated virtual network
docker run -d --name web nginx # attaches to the default bridge network automatically
docker network create my-network # or create a custom, user-defined bridge network
docker run -d --network my-network --name web nginx
Creates a private, virtual network on the host. Containers on the same bridge network can reach each other by IP. On a user-defined bridge, they can also reach each other by name, using DNS. They reach the outside world through NAT via the host. This is the right default for almost all single-host container setups.
host — no network isolation at all
docker run -d --network host nginx
The container shares the host's network namespace directly. There's no isolation, no virtual interface, and no port mapping needed. A container binding to port 80 with --network host binds to port 80 on the host itself.
This removes a layer of network translation overhead. That can matter for latency-sensitive or high-throughput workloads. But it gives up isolation entirely:
- Two containers can't both bind the same host port.
- A compromised container has direct access to the host's network stack.
none — no networking beyond loopback
docker run --network none myapp
The container gets no external network interface at all — only its own loopback address, 127.0.0.1. Use this for workloads that genuinely need zero network access: a batch job that only processes local files, or an extra layer of defense-in-depth.
overlay — connecting containers across multiple hosts
docker network create -d overlay my-overlay-network # used with Docker Swarm
Extends bridge-like networking across multiple Docker hosts. Containers on different machines can talk to each other as if they were on the same local network. This is what Docker Swarm mode uses to let services span multiple nodes while still reaching each other by name.
macvlan — a container appears as a physical device
docker network create -d macvlan --subnet=192.168.1.0/24 --gateway=192.168.1.1 -o parent=eth0 my-macvlan
Gives each container its own MAC address, so it looks like a real physical device on the host's network. This bypasses Docker's usual NAT-based bridge networking. It's used for niche cases: legacy applications or network monitoring tools that expect containers to look like individually-addressable devices, not hidden behind the host's single IP.
Choosing between them, in practice
| Driver | Typical use case |
|---|---|
| bridge (user-defined) | The default choice for nearly all single-host multi-container applications |
| host | Performance-sensitive networking, or single-purpose hosts running one dominant service |
| none | Workloads that should have no network access at all |
| overlay | Multi-host Swarm deployments |
| macvlan | Legacy applications or tooling that needs containers to appear as physical network devices |
For most everyday Docker use — a web app talking to a database, a few services on one machine — a user-defined bridge network is the right choice. It's the most common choice by far, and it's not even the same as the default bridge network.