Docker创建网络的含义？Docker Swarm overlay网络命令解析及原理咨询

Great question—overlay networks are the backbone of cross-node communication in Docker Swarm, so let's break this down piece by piece to make it clear.

1. First: What does creating a Docker network mean? #

At its core, a Docker network is a logical isolation layer that controls how containers communicate with each other, the host machine, and external networks. By default, containers on different networks can't talk to each other—this is intentional, for security and organization. Docker offers different network drivers (bridge, overlay, host, macvlan, etc.) tailored to different use cases; your command uses the overlay driver, which is built specifically for Swarm clusters.

2. Breaking down your exact command #

Let's unpack every part of docker network create --opt encrypted --subnet 100.0.0.0/24 -d overlay net1:

• docker network create: The base command to create a custom user-defined network (instead of relying on Docker's default bridge).
• --opt encrypted: Enables IPsec encryption for all traffic flowing between nodes in this overlay network. This means any data sent between containers on different nodes gets encrypted end-to-end, preventing eavesdropping on the physical network.
• --subnet 100.0.0.0/24: Specifies a fixed IP address range for the network. Docker Swarm will assign container IPs from this subnet, ensuring no conflicts and giving you predictable addressing if you need it.
• -d overlay: Tells Docker to use the overlay network driver—this is the key part that makes cross-node container communication possible in Swarm.
• net1: The human-readable name you're giving to this network, so you can reference it when deploying services or connecting containers.

3. What's an overlay network, specifically? #

An overlay network is a virtual network that "covers" the top of your Swarm cluster's physical network infrastructure. Unlike a bridge network (which only works for containers on the same node), an overlay network lets containers on different Swarm nodes communicate as if they're on the same local area network.

It works using VXLAN (Virtual Extensible LAN) technology: container traffic is encapsulated inside standard IP packets, sent across the physical network between nodes, then decrypted and delivered to the target container. This creates a seamless, private network for your Swarm services regardless of which node they're running on.

4. Internal working mechanism when you run this command #

When you execute that command on a Swarm manager node:

1. The manager propagates the network configuration to all nodes in the Swarm cluster—every node gets a copy of the overlay network's settings.
2. Each node creates the necessary network infrastructure, including a dedicated network namespace (more on that below) for the overlay network.
3. VXLAN tunnels are established between nodes: these tunnels are the virtual paths that carry encapsulated container traffic.
4. Since you added --opt encrypted, IPsec security associations are set up between nodes to encrypt all VXLAN traffic.
5. The subnet 100.0.0.0/24 is registered with Swarm's IP address manager, which handles assigning unique IPs to containers as they're deployed onto the network.

5. Does this create network namespaces? #

Yes, absolutely. Network namespaces are Linux kernel features that isolate network stacks—each namespace has its own IP addresses, routes, and network interfaces.

For overlay networks:

• Each node running containers connected to the overlay network will have a dedicated network namespace for that network.
• When a container connects to net1, it attaches to this namespace, giving it a separate network stack isolated from other containers (unless they're on the same network) and the host machine.
• The overlay network's VXLAN tunnel connects these namespaces across nodes, making cross-node communication feel like local communication to the containers.

内容的提问来源于stack exchange，提问作者CypherFancy