Docker networking and storage

Understanding how Docker handles networking and storage helps you avoid production problems. This article explains network modes, storage drivers, and volume types together.

Network modes#

Docker provides five network drivers:

bridge (the default and most common)

The default rootful bridge network typically uses docker0. Custom bridge networks use their own bridges, and containers have separate private IP addresses.

# 默认 bridge
docker run -d --name web nginx:alpine
# 容器获得 172.17.0.x IP，通过 docker0 桥接出去
# 其他容器不能通过容器名访问它

# 自定义 bridge（推荐！）
docker network create mynet
docker run -d --name web --network mynet nginx:alpine
docker run -d --name db --network mynet -e POSTGRES_PASSWORD_FILE=/run/secrets/db_password --mount type=bind,src=/path/to/protected-password-file,dst=/run/secrets/db_password,readonly postgres:16-alpine
# web 和 db 可以通过容器名互相 ping 通
# Docker 内置 DNS 服务器，自动解析容器名 → IP

graph LR
    subgraph "宿主机"
        ETH0["eth0 / 192.0.2.10"]
        NAT["NAT 转发"]
        BRIDGE["docker0 / 示例网桥地址"]
    end
    subgraph "容器"
        C1["web / 172.17.0.2"]
        C2["db / 172.17.0.3"]
    end
    C1 --- BRIDGE
    C2 --- BRIDGE
    BRIDGE --- NAT --- ETH0

host

The container uses the host's network stack directly, without its own port mapping.

docker run --network host nginx:alpine
# 容器的 80 端口 = 宿主机的 80 端口
# 不需要 -p
# 减少特定网络路径开销，效果需测量；共享网络栈增加暴露面和端口冲突风险

none

The container has no network.

docker run --network none alpine ash
# 容器内只有 lo（回环），无法访问任何网络
# 用于需要禁用常规容器网络的场景

overlay (requires a Swarm control plane)

Provides cross-host communication: containers on different physical machines share a single virtual network.

docker network create -d overlay myoverlay
# 需要 Swarm 模式开启

macvlan / ipvlan

Assigns the container an IP address on the physical network (in the same subnet as the host).

docker network create -d macvlan \
  --subnet=192.0.2.0/24 \
  --gateway=192.0.2.1 \
  -o parent=eth0 \
  mymacvlan
# 容器直接获得 192.0.2.x 的 IP
# 物理路由器能直接看到容器

Network driver quick reference#

Scenario	Recommended driver
Multiple containers on one host (most common)	`bridge` (custom)
Performance first (no port mapping needed)	`host`
Multi-node Swarm	`overlay`
The container needs a physical-network IP address	`macvlan` / `ipvlan`
Disable ordinary container networking	`none`

Port mapping in detail#

# 基本格式：宿主机IP:宿主机端口:容器端口/协议

# 映射到所有网卡
docker run -p 8080:80 nginx:alpine
# 0.0.0.0:8080 → 容器 80

# 只映射到本机（不对外暴露）
docker run -p 127.0.0.1:8080:80 nginx:alpine
# 显式绑定 loopback；旧 Engine 版本及特殊路由条件仍需核对访问边界

# 映射到指定 IP
docker run -p 192.0.2.10:8080:80 nginx:alpine

# 随机端口（宿主机端口不关心）
docker run -P nginx:alpine
# -P 自动映射 Dockerfile EXPOSE 声明的所有端口到随机宿主端口

Storage drivers#

How to choose

# 查看当前存储驱动
docker info | grep "Storage Driver"

Driver	Applicable filesystems	Notes
overlay2	Compatible ext4, xfs, and others	Common with classic storage drivers; fresh Engine 29+ installations default to the containerd image store, so check the actual configuration
fuse-overlayfs	Any	An option when rootless overlay is unavailable; check the specific kernel and feature requirements
devicemapper	—	Legacy; not recommended
btrfs	btrfs	Requires configuration and maintenance; the host filesystem type does not automatically make it the best choice
zfs	ZFS	Requires configuration and maintenance; test with your workload

How overlay2 works (simplified)

镜像层（只读）：
  Layer 4: COPY app.py
  Layer 3: RUN pip install
  Layer 2: COPY requirements.txt
  Layer 1: FROM python:3.12

容器层（读写）：
  Container Layer ← 你做的所有修改都存在这一层

Read-only image layers can be shared by multiple containers. Each container writes to its own writable layer, and copy-up may copy an entire file. Not all duplicate content is automatically deduplicated.

Comparing volume types#

Type	Data location	Lifecycle	Use cases
Volume (named volume)	`/var/lib/docker/volumes/`	Persists until manually deleted	Databases and persistent data
Bind mount	The host path you specify	The lifecycle of the host directory	Synchronizing code in development environments
tmpfs	Memory	Lost when the container stops	Temporary files, caches, and passwords

Mount permissions

# 只读挂载（容器只能读，不能写）
docker run -v /host/config:/app/config:ro nginx:alpine
#                                      └┘ 只读

# z/Z 标签（SELinux 启用时按策略选择；会重标记宿主文件，勿对系统目录盲用）
docker run -v /data:/data:Z nginx:alpine
# :Z = 这个卷只被这一个容器用
# :z = 可以被多个容器共享

Sharing data#

Sharing one volume between multiple containers

docker volume create shared

docker run -d --name writer -v shared:/data alpine sh -c "echo data > /data/file && sleep infinity"
docker run --name reader -v shared:/data alpine cat /data/file
# 输出：data

Mounting from other containers (--volumes-from)

docker run -d --name db -v pgdata:/var/lib/postgresql/data -e POSTGRES_PASSWORD_FILE=/run/secrets/db_password --mount type=bind,src=/path/to/protected-password-file,dst=/run/secrets/db_password,readonly postgres:16-alpine
docker run --rm --volumes-from db:ro --mount type=bind,src=/path/to/backup.sh,dst=/backup.sh,readonly alpine sh /backup.sh
# backup 容器可以直接访问 db 的所有卷

Practical prerequisites for data and networking#

The IP addresses in the diagrams are illustrative. Actual subnets must avoid existing routes and have a configured gateway; macvlan may also restrict direct host-to-container communication. Support for host mode depends on the platform and Desktop settings. Published ports may bypass some normal host-firewall chains, so verify exposure against Docker's networking rules.

Volume storage paths depend on the daemon's data-root, rootless operation, the Desktop VM, and the driver. A bind mount hides existing content in the container's directory; it does not delete the image directory. Whether an empty volume is populated depends on the mount method and options such as nocopy. tmpfs data can also reach swap, so it is not guaranteed to be memory-only secret storage. --volumes-from only provides access; it does not produce a consistent backup. Databases require writes to be stopped, a snapshot, or a native backup procedure.

References & further reading

Adapted from technical notes. Examples use generic names.