Docker networking is built around several drivers, each with a different isolation and use case. The bridge driver is the default: it creates an isolated network on a single host, and containers attached to it can communicate by IP. User-defined bridges (created with docker network create mynet) are recommended over the default bridge because they support automatic DNS resolution by container name, allow attaching and detaching running containers, and are fully configurable. The host driver removes network isolation entirely, sharing the host's network namespace so the container uses the host's IP and ports directly, which is useful for performance-sensitive workloads but reduces isolation and is only available on Linux. The overlay driver enables communication between containers on different Docker hosts in a Swarm cluster, using VXLAN encapsulation to create a distributed network.
Two more drivers handle specialized scenarios. The none driver attaches only a loopback interface, giving the container no external connectivity at all, which is useful for batch jobs and security-sensitive sandboxes. macvlan assigns a container a unique MAC address so it appears as a physical host on the LAN, while ipvlan shares the host's MAC and uses L3/L4 separation, working in environments that restrict MAC addresses such as some cloud providers.
Name resolution is one of the most important practical differences between network types. On a user-defined bridge network, Docker runs an embedded DNS server (reachable at 127.0.0.11 inside containers) that resolves container names, network aliases, and service names. This means a web container can reach a db container simply by calling its name. On the default bridge, however, this does not work; only IPs can be used to reach other containers. Network aliases add an extra DNS name to a container on a specific network, which is useful when the same service is reachable under different names from different networks. Containers can be attached to additional networks at runtime with docker network connect and detached with docker network disconnect. Port publication is a separate concern: EXPOSE in a Dockerfile is documentation only, while actual publication happens at runtime with docker run -p 8080:80, or with -P (uppercase) which publishes every EXPOSEd port to random host ports. Default IP ranges for bridge networks fall in the 172.x.0.0/16 space, with the host at .0.1, and these can be overridden per network with --subnet and --gateway.