为什么 Docker 会阻止将容器附加到主机和用户定义的桥接网络？

Question

Why is it that Docker prohibits attaching a container to both the host and user defined bridge network?

Secondly, for deployments that require disabling IP forwarding on the host machine does docker recommend deploying docker containers with host networking only, since based on what i understand that seems to be the only option left.

Any insights on the above two?

Thanks

Answer 1

Why is it that Docker prohibits attaching a container to both the host and user defined bridge network?

Because there's no way to "attach" networks when a container is running in the host network namespace.

Docker attaches networks by adding virtual interfaces to a container's isolated network namespace. When running in the global network namespace, there's no sane way to do this: any new interfaces wouldn't be restricted to the container, and would potentially disrupt host networking.

Secondly, for deployments that require disabling IP forwarding on the host machine does docker recommend deploying docker containers with host networking only, since based on what i understand that seems to be the only option left.

That's probably the only easy option.

You could run a proxy service on the host that would expose services in Docker containers. You could potentially even automate that by monitoring the Docker for events and getting information about published ports. Otherwise you would need to manually implement the appropriate configuration.