What is an overlay network, and when is it needed?
Quick Answer
An overlay network extends Docker's virtual networking across multiple hosts. Containers on different machines can talk to each other as if they were on the same local network, using VXLAN to tunnel traffic between hosts. It's needed for multi-host deployments, most commonly Docker Swarm mode, since a plain bridge network is confined to a single host and can't reach a container running elsewhere.
Detailed Answer
Why bridge networks alone don't work across multiple hosts
A bridge network, default or user-defined, is a local, single-host construct. It's a virtual network interface — docker0, or a custom bridge — that only exists on one machine. A container on Host A has no native way to reach a container on Host B using ordinary bridge networking. There's no shared virtual network spanning both machines, just two separate bridge networks that happen to exist independently on each host.
What an overlay network adds: a virtual network spanning multiple hosts
# On a Docker Swarm manager node
docker network create -d overlay my-overlay-network
docker service create --name web --network my-overlay-network --replicas 3 nginx
An overlay network creates a single virtual network that spans every host in the same Swarm cluster. A container — technically a Swarm "task" — running on any node can reach another by name, just like on a single-host bridge network, even though they're on entirely different machines.
The mechanism: VXLAN encapsulation
Overlay networking works by encapsulating container-to-container traffic inside VXLAN (Virtual Extensible LAN) packets. These packets travel across the hosts' normal underlying network, then get de-encapsulated on arrival at the destination host.
This is similar to how some Kubernetes CNI plugins, like Flannel's VXLAN mode, make pods on many nodes appear to share one flat network. Same technique, same underlying problem.
Host A: container "web-1" sends traffic to container "web-2" (on Host B)
→ VXLAN-encapsulated, sent over Host A's and Host B's REAL network connection
→ de-encapsulated on arrival at Host B
→ delivered to "web-2" as if it had arrived over a normal local bridge network
When you actually need this
Overlay networking matters specifically when running Docker Swarm mode across more than one node. It's the networking layer that makes Swarm's multi-host service deployment and scaling work — letting a service's replicas spread across several machines while still reaching each other reliably.
If you're running plain Docker on a single host, or using Kubernetes instead of Swarm for multi-host orchestration, you generally won't touch Docker's overlay network driver directly. Kubernetes has its own CNI-plugin-based networking model that solves the same multi-host connectivity problem in its own way.