Answers: <p>Docker should avoid using a network if there's a route to that network (see <code>ip r</code>). You can whitelist networks that docker is allowed to use with configurations in several places:</p>
  
  <ul>
  <li>You can adjust <code>bip</code> in <code>/etc/docker/daemon.json</code> which controls the docker bridge network named bridge. This needs to be set to a gateway ip with CIDR notation.</li>
  <li>You can adjust <code>default-address-pools</code> in <code>/etc/docker/daemon.json</code> which is a list of CIDR blocks for all other bridge networks.</li>
  <li>You can pass <code>--default-addr-pool</code> when initializing a swarm to a CIDR block for overlay networks.</li>
  </ul>
  
  <p>Make sure the two pools are large enough to create multiple networks, e.g. a <code>/16</code> subnet to allow creation of 256 <code>/24</code> networks.</p>
  
  <p>More details of this are available in my <a href="https://sudo-bmitch.github.io/presentations/dc2019/tips-and-tricks-of-the-captains.html#address-pools" rel="nofollow noreferrer">DockerCon presentation</a> (press <code>P</code> for presenter notes).</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-04-02T17:58:11.503Z
Answers: That is great knowledge. Thanks a lot!
Answers: Worp
Answers: CC BY-SA 4.0
Answers: 2020-04-02T15:17:43.707Z
Answers: 2020-04-02T15:17:43.707Z
Answers: BMitch
Body: <p>Basically I need to blacklist an IP range (and maybe multiple ranges) so that Docker can use any other IPs for its containers BUT IPs in this range.</p>
  
  <p>Assume I have my docker nodes in a swarm of n nodes. They are in IP range <code>10.1.1.0/24</code>. There are multiple other VMs in this IP range like a VPN Server, a firewall, etc.</p>
  
  <p>Can I restrict Docker from assigning IPs from this range to containers it starts?</p>
  
Tags: <docker><networking><docker-daemon>
Title: Blacklist network ranges Docker is allowed to use for its containers (swarm mode)
UserDisplayName: Worp
ThreadText: # Blacklist network ranges Docker is allowed to use for its containers (swarm mode)
  
  (Asked by: username_0 on 2020-04-02)
  
  Basically I need to blacklist an IP range (and maybe multiple ranges) so that Docker can use any other IPs for its containers BUT IPs in this range.
  
  Assume I have my docker nodes in a swarm of n nodes. They are in IP range `10.1.1.0/24`. There are multiple other VMs in this IP range like a VPN Server, a firewall, etc.
  
  Can I restrict Docker from assigning IPs from this range to containers it starts?
  
  **Tags:** docker, networking, docker-daemon
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-04-02. Score: 4 | Accepted answer
  
  Docker should avoid using a network if there's a route to that network (see `ip r`). You can whitelist networks that docker is allowed to use with configurations in several places:
  
  * You can adjust `bip` in `/etc/docker/daemon.json` which controls the docker bridge network named bridge. This needs to be set to a gateway ip with CIDR notation.
  * You can adjust `default-address-pools` in `/etc/docker/daemon.json` which is a list of CIDR blocks for all other bridge networks.
  * You can pass `--default-addr-pool` when initializing a swarm to a CIDR block for overlay networks.
  
  Make sure the two pools are large enough to create multiple networks, e.g. a `/16` subnet to allow creation of 256 `/24` networks.
  
  More details of this are available in my [DockerCon presentation](https://sudo-username_1.github.io/presentations/dc2019/tips-and-tricks-of-the-captains.html#address-pools) (press `P` for presenter notes).
  
  > **Comments:**
  > **username_0**: That is great knowledge. Thanks a lot!  
  
  ---
  
  