1

Basically I need to blacklist an IP range (and maybe multiple ranges) so that Docker can use any other IPs for its containers BUT IPs in this range.

Assume I have my docker nodes in a swarm of n nodes. They are in IP range 10.1.1.0/24. There are multiple other VMs in this IP range like a VPN Server, a firewall, etc.

Can I restrict Docker from assigning IPs from this range to containers it starts?

Improve this question

1 Answer 1

Reset to default
4

Docker should avoid using a network if there's a route to that network (see ip r). You can whitelist networks that docker is allowed to use with configurations in several places:

  • You can adjust bip in /etc/docker/daemon.json which controls the docker bridge network named bridge. This needs to be set to a gateway ip with CIDR notation.
  • You can adjust default-address-pools in /etc/docker/daemon.json which is a list of CIDR blocks for all other bridge networks.
  • You can pass --default-addr-pool when initializing a swarm to a CIDR block for overlay networks.

Make sure the two pools are large enough to create multiple networks, e.g. a /16 subnet to allow creation of 256 /24 networks.

More details of this are available in my DockerCon presentation (press P for presenter notes).

Improve this answer
1
  • That is great knowledge. Thanks a lot!
    – Worp
    Commented Apr 2, 2020 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.