How does docker0 bridge work internally inside the host?

Question

I am trying to understand how the bridged docker0 interface works.

• When docker daemon starts up, it creates a bridged device docker0;
• When a container starts up, it creates a interface vthn and bind to docker0

say we issue a ping command from inside the container to a external host

[root@f505f022eb5b app]# ping 130.49.40.130
PING 130.49.40.130 (130.49.40.130) 56(84) bytes of data.
64 bytes from 130.49.40.130: icmp_seq=1 ttl=52 time=11.9 ms

so apprently my host eth0 is receiving this ping back, but how does this package get forwarded to the container? There are serveral questions to ask

• eth0 and docker0 are not bridged, how come docker0 get the packets from eth0?
• even if docker0 got the packets, how it works internally sending packets to vth0? does it internally maintains some Maps so it can convert packets to between different mac address?
• how is iptables related here?

Cheers.

Answer 1

Docker is not doing anything specifically magical here and your question is not really docker dependant/related.

docker0 is just a network bridge. As soon as this bridge is created (upon starting the docker service) you can assume that a new machine (in this case in a VM/docker form) has joined the your network.

When pinging the docker container from host or vice versa you are basically pinging another machine inside your network.

Regarding docker, unless you have created a new network interface (which I doubt so since you are pinging eth0) you are basically pinging yourself.

If you run the container as:

docker run -i -t --rm -p 10.0.0.99:80:8080 ubuntu:16.04

You are telling docker to create a NAT rule in iptables to forward any packets going to 10.0.0.99:80 to your docker container on port 8080.

When you run the container as:

docker run -i -t --rm -p --net=host ubuntu:16.04

Then you are saying the docker container should have the same network stack as the host so all the packets going to host will also arrive to your docker container via the docker0 bridge.