Docker - how to avoid bridge ip?

Question

Docker is taking the ip 172.19.0.1 on the br-80db19b2a6a0 interface. I want to avoid this ip, because it maps to our mail server.

Those are the interfaces (Linux machine):

br-096c79c68bb1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet6 fe80::42:94ff:feb0:6dc9  prefixlen 64  scopeid 0x20<link>
        ether 02:42:94:b0:6d:c9  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 106  bytes 14176 (14.1 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

br-80db19b2a6a0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.19.0.1  netmask 255.255.0.0  broadcast 172.19.255.255
        inet6 fe80::42:f3ff:fe4e:f91  prefixlen 64  scopeid 0x20<link>
        ether 02:42:f3:4e:0f:91  txqueuelen 0  (Ethernet)
        RX packets 466  bytes 18568 (18.5 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 515  bytes 40663 (40.6 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

docker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.1.5  netmask 255.255.255.0  broadcast 192.168.1.255
        ether 02:42:dc:23:25:46  txqueuelen 0  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

enp0s31f6: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.18.17.167  netmask 255.255.255.0  broadcast 172.18.17.255
        inet6 fe80::f68e:38ff:fefe:6cfd  prefixlen 64  scopeid 0x20<link>
        ether f4:8e:38:fe:6c:fd  txqueuelen 1000  (Ethernet)
        RX packets 1436  bytes 1254171 (1.2 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 818  bytes 125043 (125.0 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 20  memory 0xee080000-ee0a0000  

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Loopback Local)
        RX packets 3553  bytes 365530 (365.5 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3553  bytes 365530 (365.5 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

How can I do it?

Answer 1

I couldn't find a complete answer anywhere. But I worked basically all day on this, so I will share a complete solution with background information I discovered.

The Solution

# Remove the network.
# This first line might not be needed.
sudo ip link delete br-80db19b2a6a0
docker network rm 80db19b2a6a0

# Edit daemon.json and create a list of allowed IP blocks. (See below.)
sudo vim /etc/docker/daemon.json
#sudo nano /etc/docker/daemon.json

# Restart the Docker service.
sudo systemctl restart docker

# Verify
ifconfig

/etc/docker/daemon.json

{
  "default-address-pools": [
    {"base":"10.10.0.0/16","size":24},
    {"base":"192.168.0.0/24","size":24}
  ]
}

Background info

• br-096c79c68bb1, br-80db19b2a6a0, and any other br-* interfaces are Docker bridge networks.
• The ID 80db19b2a6a0 corresponds to the Docker network ID
  • You can see a list of the networks with docker network ls to see which one it is.
• If you need to remove the network as a temporary fix to be able to access the Internet quick, you can run sudo ip link delete br-80db19b2a6a0. Then you can run ip a or ifconfig again to see it has been removed. However, it will be recreated the next time the docker service is restarted.
• If you want to limit the IP subnets that Docker will get IPs from, you can create/edit /etc/docker/daemon.json and add a list of allowed subnets like this:

{
  "default-address-pools": [
    {"base":"10.10.0.0/16","size":24},
    {"base":"192.168.0.0/24","size":24}
  ]
}

• Note: even if you create daemon.json like this, and delete the bridge network interface, it will still be created with the exact same IP when the docker service is restarted. Unless you do the next step first...
• Run docker network rm 80db19b2a6a0. Then restart the docker service.

Potential symptoms

I ran into this problem, and I was unable to ping (in WSL) any machine on the network that conflicted with the bridge's subnet. I couldn't reach the sites using curl, git, ssh or anything else either.

$ ping -4 my-site.example.com
PING my-site.example.com ([the site IP]) 56(84) bytes of data.
From [Conflicting Docker bridge IP] ([Conflicting Docker bridge IP]) icmp_seq=1 Destination Host Unreachable

nmap says the Host seems down, unless you use the -Pn flag (to not check the host status and continue as if it is up.)

Sources

These had partial solutions, but not a complete solution.

• Docker Bridge Conflicts with Host Network
• ERROR: Pool overlaps with other one on this address space when starting my_project docker setup