Engine networking updates for moby 29.0 #23215

robmry · 2025-08-07T14:50:03Z

Description

Some clarifications and a hopefully-gentler intro for the networking overview page
Bridge driver - add some more intro words
With nftables on the way - refer to "firewall" instead of "iptables" in the top-level description in packet-filtering-firewalls.md, move out the iptables specifics, and port-publishing (which applies to both iptables and nftables).
Add firewall-nftables.md describing migration to experimental --firewall-backend=nftables.

Reviews

Technical review - @akerouanton
Editorial review - @ArthurFlag
Product review

netlify · 2025-08-07T14:50:20Z

✅ Deploy Preview for docsdocker ready!

Name	Link
🔨 Latest commit	`f312d53`
🔍 Latest deploy log	https://app.netlify.com/projects/docsdocker/deploys/68a82e3a6e723d0008c7a6d3
😎 Deploy Preview	https://deploy-preview-23215--docsdocker.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

content/manuals/engine/network/_index.md

content/manuals/engine/network/drivers/bridge.md

content/manuals/engine/network/_index.md

content/manuals/engine/network/firewall-iptables.md

akerouanton · 2025-08-11T15:24:54Z

content/manuals/engine/network/firewall-iptables.md

+However, this is not recommended for most users as it will likely break
+container networking.
+
+### Docker and iptables chains


Maybe worth mentioning the raw-PREROUTING chain somewhere (but this may not be the most appropriate section though)?

content/manuals/engine/network/port-publishing.md

akerouanton · 2025-08-11T15:43:36Z

content/manuals/engine/network/port-publishing.md

+In `nat` mode, when a port is published to a specific host address, that
+port is only accessible via the host interface with that address. So,


That's not true. If a Docker host has two NICs with addresses 192.168.100.10/24 and 10.0.0.10/24, IP forwarding is enabled, and a port published on 192.168.100.10, another host in the 10.0.0.0/24 subnet can access that port if its routing table has an entry for routing 192.168.100.10 via 10.0.0.10.

Any chance you could offer a suggestion here? I'm not familiar enough with networking 😬

Any chance you could offer a suggestion here? I'm not familiar enough with networking 😬

I can pick this up.

I've rearranged the surrounding paragraphs a bit, and added a "Note" block about direct routing to addresses on other host interfaces.

akerouanton · 2025-08-11T15:45:26Z

content/manuals/engine/network/port-publishing.md

+for example, publishing a port to an address on the loopback interface
+means remote hosts cannot access it.


But this part is true as loopback addresses aren't intended to be routed.

akerouanton · 2025-08-11T15:51:16Z

content/manuals/engine/network/port-publishing.md

+This changes the default binding address to `127.0.0.1` for published container
+ports on the default bridge network.
+Restart the daemon for this change to take effect.
+Alternatively, you can use the `dockerd --ip` flag when starting the daemon.


This is rendered as a single line (see here), so no need to put extra new lines in the md file.

This is rendered as a single line (see here), so no need to put extra new lines in the md file.

But semantic linefeeds are a thing.

akerouanton

I realize that one of my earlier suggestion is slightly wrong 🙈 Otherwise, LGTM.

content/manuals/engine/network/_index.md

robmry

@ArthurFlag - thank you for making the updates, I think they're all related to pre-existing text that moved, so maybe a review on my own PR counts (!) ... they LGTM.

robmry · 2025-08-26T11:29:49Z

content/manuals/engine/network/port-publishing.md

@@ -44,8 +44,7 @@ Here are some examples:
 > the outside world as well.
 >
 > If you include the localhost IP address (`127.0.0.1`, or `::1`) with the
-> publish flag, only the Docker host and its containers can access the
-> published container port.
+> publish flag, only the Docker host.


Suggested change

> publish flag, only the Docker host.

> publish flag, only the Docker host can access the published container port.

robmry · 2025-08-26T11:39:06Z

content/manuals/engine/network/port-publishing.md

+This changes the default binding address to `127.0.0.1` for published container
+ports on the default bridge network.
+Restart the daemon for this change to take effect.
+Alternatively, you can use the `dockerd --ip` flag when starting the daemon.


This is rendered as a single line (see here), so no need to put extra new lines in the md file.

But semantic linefeeds are a thing.

robmry · 2025-08-26T11:39:35Z

content/manuals/engine/network/port-publishing.md

+In `nat` mode, when a port is published to a specific host address, that
+port is only accessible via the host interface with that address. So,


Any chance you could offer a suggestion here? I'm not familiar enough with networking 😬

I can pick this up.

robmry · 2025-08-26T14:00:01Z

@ArthurFlag - shall I squash the review-comment commits to tidy up the history?

Not sure what happened in the "path-warnings" test, it says ...

#18 [npm 2/2] RUN --mount=source=package.json,target=package.json     --mount=source=package-lock.json,target=package-lock.json     --mount=type=cache,target=/root/.npm     npm ci
#18 1.262 npm error code E403
#18 1.262 npm error 403 403 Forbidden - GET https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz
#18 1.262 npm error 403 In most cases, you or one of your dependencies are requesting
#18 1.262 npm error 403 a package version that is forbidden by your security policy, or
#18 1.262 npm error 403 on a server you do not have access to.
#18 1.264 npm error A complete log of this run can be found in: /root/.npm/_logs/2025-08-26T13_56_56_669Z-debug-0.log
#18 ERROR: process "/bin/sh -c npm ci" did not complete successfully: exit code: 1

ArthurFlag · 2025-08-26T15:11:55Z

No need to squash the history, you can just squash and merge when ready :)

Great work 🙇

Oh and yeah, the npm registry is struggling today. These are non-required tests, no worries.

Signed-off-by: Rob Murray <rob.murray@docker.com>

With nftables on the way - refer to "firewall" instead of "iptables" in the top-level description of packet-filtering-firewalls, move out the iptables specifics, and port-publishing (which applies to both iptables and nftables). Signed-off-by: Rob Murray <rob.murray@docker.com>

Adds engine/network/firewall-nftables.md Signed-off-by: Rob Murray <rob.murray@docker.com>

robmry · 2025-08-27T17:04:11Z

No need to squash the history, you can just squash and merge when ready :)

Thanks Arthur. It's probably marginally worth keeping the original four commits separate, so I squashed the updates into them.

I don't have merge-powers here, but I see the target's now branch moby29, so I guess it can be merged when @akerouanton is happy with the updates.

robmry requested review from thaJeztah and ArthurFlag as code owners August 7, 2025 14:50

robmry mentioned this pull request Aug 7, 2025

Split iptables and port publishing into separate pages #23217

Closed

3 tasks

github-actions bot added area/engine Issue affects Docker engine/daemon area/networking Relates to anything around networking labels Aug 7, 2025

robmry changed the title ~~Engine networking overview updates~~ Engine networking updates for moby 29.0 Aug 7, 2025

robmry force-pushed the moby_networking_tweaks branch 3 times, most recently from fbdde7d to 4309ba9 Compare August 8, 2025 11:21

akerouanton reviewed Aug 11, 2025

View reviewed changes

ArthurFlag changed the base branch from main to moby29 August 22, 2025 08:59

akerouanton approved these changes Aug 22, 2025

View reviewed changes

content/manuals/engine/network/_index.md Outdated Show resolved Hide resolved

robmry commented Aug 26, 2025

View reviewed changes

ArthurFlag approved these changes Aug 26, 2025

View reviewed changes

robmry added 4 commits August 27, 2025 17:57

Networking overview - clarifications and gentler intro.

36debb4

Signed-off-by: Rob Murray <rob.murray@docker.com>

Bridge network driver: add high-level description

44b2cbd

Signed-off-by: Rob Murray <rob.murray@docker.com>

Describe migration from iptables to experimental nftables

2b123b9

Adds engine/network/firewall-nftables.md Signed-off-by: Rob Murray <rob.murray@docker.com>

robmry force-pushed the moby_networking_tweaks branch from ea7e170 to 2b123b9 Compare August 27, 2025 16:58

		In `nat` mode, when a port is published to a specific host address, that
		port is only accessible via the host interface with that address. So,

		for example, publishing a port to an address on the loopback interface
		means remote hosts cannot access it.

	> publish flag, only the Docker host.
	> publish flag, only the Docker host can access the published container port.

Engine networking updates for moby 29.0 #23215

Are you sure you want to change the base?

Engine networking updates for moby 29.0 #23215

Uh oh!

Conversation

robmry commented Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Reviews

Uh oh!

netlify bot commented Aug 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for docsdocker ready!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

akerouanton Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

akerouanton Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

ArthurFlag Aug 25, 2025

Choose a reason for hiding this comment

Uh oh!

robmry Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robmry Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

akerouanton Aug 11, 2025

Choose a reason for hiding this comment

Uh oh!

akerouanton Aug 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robmry Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akerouanton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

robmry left a comment

Choose a reason for hiding this comment

Uh oh!

robmry Aug 26, 2025

Choose a reason for hiding this comment

Uh oh!

robmry Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robmry Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robmry commented Aug 26, 2025

Uh oh!

ArthurFlag commented Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

robmry commented Aug 27, 2025

Uh oh!

Uh oh!

robmry commented Aug 7, 2025 •

edited

Loading

netlify bot commented Aug 7, 2025 •

edited

Loading

robmry Aug 26, 2025 •

edited

Loading

akerouanton Aug 11, 2025 •

edited

Loading

robmry Aug 26, 2025 •

edited

Loading

robmry Aug 26, 2025 •

edited

Loading

robmry Aug 26, 2025 •

edited

Loading

ArthurFlag commented Aug 26, 2025 •

edited

Loading