Keep the legacy-link reference while warning that default-bridge links
and legacy-link environment variables are scheduled for removal in
Docker Engine 30.0.
Document the environment variable escape hatch.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
When something else (e.g. a CNI) rewrites packets to a container IP
before host netfilter, Docker's unpublished-port protection still
applies. `DOCKER-USER` never sees that as "published" traffic.
Added a short note under the iptables DOCKER-USER section pointing at
port publishing / `nat-unprotected`.
Fixes#25676
---------
Signed-off-by: Dean Chen <862469039@qq.com>
## Summary
Document the DSR option for Linux east-west overlay traffic and restore
the legacy overlay tutorial redirect.
Closes#9652
Generated by Codex
Co-authored-by: Codex <noreply@openai.com>
Resolver libraries can query multiple DNS servers differently, making results depend on the container network and runtime. Add a note distinguishing application-controlled lookups on the default bridge from Docker's ordered upstream lookups on custom networks.
Co-Authored-By: Codex <noreply@openai.com>
The overlay networking docs omitted the supported DSR driver option. Document Linux east-west DSR usage and restore the legacy tutorial redirect.
Co-Authored-By: Codex <noreply@openai.com>
Add a "Use router-assigned IPv6 addresses" subsection to the macvlan and
ipvlan driver pages explaining how to receive IPv6 addresses via SLAAC
instead of Docker IPAM. Setting the per-interface net.ipv6.conf.IFNAME.disable_ipv6
sysctl to 0 via the endpoint.sysctls driver option re-enables IPv6 on the
interface so it can accept router advertisements, and the section links to
the docker network connect sysctl reference for the full mechanism.
Also add ipv6 and slaac keywords to both pages to improve discoverability.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The port requirements were listed twice: as a bullet list under
Requirements and as a more detailed table under Create an overlay
network. Keep the detailed table under Requirements, where the port
requirements belong, and drop the redundant copy.
Fixes#25073
The L3 dual-stack IPVLAN example omitted the --ipv6 flag when creating
the network, causing Docker to default to EnableIPv6: false despite an
IPv6 subnet being specified. The L2 example already includes this flag.
Fixes#19337
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a brief mention of the embedded DNS server IP address (127.0.0.11)
to the DNS services section of the networking overview. Notes that
there is no IPv6 equivalent and that applications like Nginx can use
this address for explicit DNS configuration.
Fixes#20532
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Rob Murray <rob.murray@docker.com>
Co-authored-by: Rob Murray <rob.murray@docker.com>
Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
## Description
~**This update is for moby 28.2.0 - do not merge until it ships.**~ -
28.2 has shipped now.
Add description for daemon option `--allow-direct-routing` and network
option `com.docker.network.bridge.trusted_host_interfaces`.
## Related issues or tickets
https://github.com/moby/moby/pull/49832
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: Rob Murray <rob.murray@docker.com>
## Description
- Describe new iptables chain `DOCKER-FORWARD`, which splits Docker's
rules out of the main `FORWARD` chain where they were being antisocial -
related to https://github.com/moby/moby/pull/49518
- Update notes about IP Forwarding and the default DROP policy
- Only engine < 28.0.0 allows remote access to ports published to the
localhost address
## Related issues or tickets
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Rob Murray <rob.murray@docker.com>
<!--Delete sections as needed -->
## Description
```
$ docker network create --help | grep opt
--ipam-opt map Set IPAM driver specific options (default map[])
-o, --opt map Set driver specific options (default map[])
```
So the documentation should be changed from using --option to --opt.
