Container Networking: Docker & Kubernetes Connectivity

Container networking is the system that lets Docker containers and Kubernetes pods talk to each other and the outside world, using virtual network interfaces, bridges, and routing rules instead of physical hardware. This article explains how Docker’s default bridge network and Kubernetes’ pod-and-service model work, then covers common problems and how to troubleshoot them.

The Problem: Containers Need Isolation and Connectivity

Containers are isolated processes, but isolation alone isn’t useful. An application usually has multiple parts—a web server, a database, a cache—and those parts need to communicate. At the same time, you don’t want every container to see every other container’s traffic. Container networking solves this by giving each container its own virtual network stack (IP address, routing table, ports) while connecting them through software-defined networks.

Docker and Kubernetes solve the same problem at different scales. Docker is typically used for single-host container management, while Kubernetes orchestrates containers across many machines. Their networking models reflect that difference.

How Docker Networking Works

When you install Docker, it creates three default networks: bridge, host, and none. The default is bridge, which is a private network inside your host. Here’s what happens when you run a container without specifying a network:

1. Docker creates a virtual bridge interface (usually named docker0) on the host.
2. It assigns a private IP range, typically 172.17.0.0/16, to that bridge.
3. For each container, Docker creates a virtual Ethernet pair (veth). One end goes into the container’s network namespace, the other is attached to the bridge.
4. The container gets an IP from the bridge’s range (e.g., 172.17.0.2).
5. To reach the outside world, Docker uses Network Address Translation (NAT) via iptables, so the container’s private IP is masqueraded behind the host’s IP.

Containers on the same bridge can talk to each other directly by IP. But they cannot reach containers on a different bridge network unless you connect them to the same network or use routing.

Port publishing is how you expose a container to the outside. When you run docker run -p 8080:80 nginx, Docker adds a DNAT rule in iptables that forwards traffic from the host’s port 8080 to the container’s port 80. The container itself still has its own private IP; it’s the host that receives the external request.

For multi-host networking, Docker offers overlay networks (via Swarm mode) or you can use third-party plugins like Calico or Weave. Overlay networks tunnel traffic between hosts using VXLAN or similar protocols, so containers on different hosts appear to be on the same LAN.

How Kubernetes Networking Works

Kubernetes doesn’t use Docker’s bridge network directly (though it can use containerd or other runtimes). Instead, it has a more abstract model with three requirements:

• Every pod gets its own unique IP address, visible to all other pods without NAT.
• Pods on different nodes can communicate directly.
• Services provide stable virtual IPs that load-balance across pods.

These requirements are not built into Kubernetes itself; they are implemented by a CNI (Container Network Interface) plugin like Calico, Flannel, Weave, or Cilium. The CNI plugin is responsible for setting up the network on each node.

Here’s how it works at a high level:

1. When a pod is scheduled to a node, the kubelet calls the CNI plugin to create a network namespace for the pod.
2. The plugin assigns an IP address from a pool (often a /24 per node).
3. It creates a virtual Ethernet pair, one end in the pod’s namespace, the other on a bridge or a routing table.
4. The plugin then configures routing so that pods on other nodes can reach this pod via the node’s IP (often using overlay tunnels or BGP).

Because every pod has a real IP, Kubernetes does not need NAT between pods. This simplifies service discovery and makes it easier to run legacy applications that expect direct IP connectivity.

Kubernetes Services and kube-proxy

Pods are ephemeral—they come and go. To provide a stable endpoint, Kubernetes uses Services. A Service is a virtual IP (ClusterIP) backed by a set of pods selected by labels. When you send traffic to the Service IP, it is forwarded to one of the backing pods.

The forwarding is done by kube-proxy, a component running on every node. kube-proxy watches the Kubernetes API for Services and Endpoints, then programs iptables (or IPVS) rules to redirect traffic. For example, if a Service has ClusterIP 10.96.0.1 and three pods, kube-proxy installs DNAT rules that randomly pick one of the pod IPs.

This is why Kubernetes services are not load balancers in the traditional sense—they are client-side load balancers implemented in the kernel.

There are also NodePort and LoadBalancer services. NodePort exposes the Service on a high port (30000-32767) on every node, and LoadBalancer provisions an external load balancer (in cloud environments) that forwards to NodePorts.

DNS and Service Discovery

Kubernetes includes a built-in DNS service (CoreDNS). When you create a Service, CoreDNS automatically creates a DNS record like my-service.my-namespace.svc.cluster.local. Pods can use this name instead of hardcoding IPs. This is essential because pod IPs change frequently.

Docker also has a built-in DNS (127.0.0.11) for user-defined networks, but it only resolves container names within the same network. In Docker Compose, services can reach each other by service name.

Common Problems and Troubleshooting

Container networking issues are common, but they usually fall into a few categories:

• DNS resolution fails: In Kubernetes, check if CoreDNS pods are running (kubectl get pods -n kube-system). In Docker, ensure the container is on a user-defined network, not the default bridge, because the default bridge does not have automatic DNS.
• Can’t reach a container from outside: Check if the port is published correctly (docker ps shows the mapping). For Kubernetes, check the Service type and NodePort range.
• Pods can’t talk to each other across nodes: Verify the CNI plugin is installed and healthy. Check network policies that might be blocking traffic.
• IP address conflicts: If you manually assign IPs, make sure they don’t overlap with the pod CIDR or service CIDR.
• Performance issues: Overlay networks (like VXLAN) add overhead. If you need low latency, consider a routing-based CNI like Calico with BGP.

Frequently Asked Questions

What is the difference between Docker bridge and host networking?

Bridge networking gives the container its own IP and NATs traffic to the outside. Host networking removes the isolation: the container shares the host’s network namespace, so it uses the host’s IP and ports directly. Host mode is faster but less isolated and can cause port conflicts.

Why can’t I ping a Kubernetes pod from another pod?

Ping uses ICMP, and some CNI plugins or network policies block ICMP. Also, if the pods are on different nodes, the overlay network must be configured correctly. Check the CNI plugin logs and try a TCP connection instead (e.g., using nc or curl).

How do I expose a Kubernetes service to the internet?

Use a Service of type LoadBalancer (in cloud environments) or NodePort, then access it via any node’s IP and the NodePort. For production, you typically use an Ingress controller that routes HTTP traffic to Services based on hostname or path.

What is a CNI plugin and do I need one?

CNI (Container Network Interface) is a standard that defines how container runtimes set up networking. Kubernetes requires a CNI plugin to provide pod networking. Without one, pods will be created but cannot get an IP address. Common plugins include Calico, Flannel, and Weave.

Can Docker containers talk to Kubernetes pods?

Not directly, because they are on different networks. You need to expose the Kubernetes service via NodePort or LoadBalancer and then have the Docker container connect to that IP/port. Alternatively, you can run Docker containers on the same host and use host networking, but that’s fragile.

How do I debug a container that can’t reach the internet?

First, check if the container can reach the DNS server (nslookup google.com). If DNS works but HTTP doesn’t, check the firewall rules on the host. If DNS fails, check the container’s resolv.conf and the host’s iptables NAT rules. Also, ensure the container has a route to the default gateway.

Related

• Acer Collection S: Decline or Uninstall?
• C Drive Space Error: Fix ‘Not Enough Space to Extract
• Project Sekai EN Events: Current & Full Schedule