66

Due to problems with captive portals and the default Docker IP range I am trying to make Docker use the 198.18.0.0 range, instead of 172.17.0.0, which clashes with the captive portals used on the trains where I live.

Following the docs, I created /etc/docker/daemon.json, and put the following in it:

{
    "bip":"198.18.0.0/16"
}

This worked for docker0, but it seems to not have affected any of the other networks, and using docker compose the first network created is 172.17.0.0, which recreates the clash.

What can I do to change the default subnet for all docker networks (preferably without having to state my custom IP range in every compose file)?

tgogos
  • 103
  • 1
  • 4
jrtapsell
  • 986
  • 1
  • 9
  • 15

5 Answers5

79

It is possible to redefine default range.

$ docker -v
Docker version 18.06.0-ce, build 0ffa825

Edit or create config file for docker daemon:

# nano /etc/docker/daemon.json

Add lines:

{
  "default-address-pools":
  [
    {"base":"10.10.0.0/16","size":24}
  ]
}

Restart dockerd:

# service docker restart

Check the result:

$ docker network create foo
$ docker network inspect foo | grep Subnet
                    "Subnet": "10.10.1.0/24"

It works for docker-compose too. More info here https://github.com/moby/moby/pull/29376 (merged)

rNix
  • 906
  • 6
  • 4
  • 2
    10.10.0.0/16 overlaps with global default networks. You can use {"base":"192.168.0.0/16","size":24}. Please see https://github.com/moby/moby/blob/0ac8cbf74765ca32e1b82df343bdf52ebb0fb6e2/vendor/github.com/docker/libnetwork/ipamutils/utils.go#L21 – Root G Apr 06 '19 at 13:54
  • For those who are on windows and feel better with clicking around: Open Docker-settings via right-click on the taskbar-icon and add the above mentioned lines under the menu "Docker Engine". Then "Apply & Restart". I'm on docker desktop community Version 2.2 – Tobse Feb 08 '20 at 13:52
  • I had better luck by creating this daemon.json (default one didn't exist for me): `{"bip": "192.168.1.5/24", "fixed-cidr": "192.168.1.5/25", "default-address-pools":[ {"base":"192.168.2.5/24","size":28} ] }`. I never found a good description of what the requirements for the ranges were or exactly how they were used. IMO docker should not be looking at existing routes, especially in the context of a VPN! – jozxyqk Aug 11 '20 at 19:57
  • Afterwards I had to manually remove the docker networks and re-create all the containers. – cweiske May 04 '22 at 05:56
40

There are three places docker will generate network subnets.

  • The default bridge
  • User generated bridge networks
  • Swarm mode generated overlay networks

For the default bridge (called "bridge"), you can specify BIP (I believe that's Bridge IP; make sure it's a host IP, not a network IP) in the daemon.json file. And for user generated bridge networks you can define a subnet pool to pick from (assuming the user does not manually specify a subnet). For these two, your /etc/docker/daemon.json would look like:

{
  "bip": "10.200.0.1/24",
  "default-address-pools":[
    {"base":"10.201.0.0/16","size":24},
    {"base":"10.202.0.0/16","size":24}
  ]
}

Each address pool setting above defines a CIDR range and size of subnets to be allocated from that range. So the above defines two class B ranges that are allocated as class C networks (/24). You do need at least 18.06 for the default address pools. You will need to reload the docker daemon for this change to apply (systemctl reload docker). And this change will only modify newly created user networks, so you'll need to stop containers and delete existing networks in the wrong range.

In 18.09, Docker added the ability to specify the address range for swarm mode generated overlay networks. This can only be done at the time of swarm creation right now, hopefully that will be updated in the future to allow docker swarm update to adjust these pools:

$ docker swarm init \
  --default-addr-pool 10.202.0.0/16 \
  --default-addr-pool 10.203.0.0/16 \
  --default-addr-pool-mask-length 24
desolat
  • 105
  • 3
BMitch
  • 5,189
  • 1
  • 21
  • 30
  • 1
    Great summary of current 2018/2019 options. Also, if using Docker Desktop, the `bip` option in the Settings/Preferences GUI. For `default-address-pools` you can edit the daemon.json manually in that same GUI, and for swarm's `default-addr-pool` you still change them with the `init` command. – Bret Fisher Feb 10 '19 at 23:31
  • can one use `/8` instead of the multiple `/16`? – uberrebu Apr 27 '21 at 21:07
  • @uberrebu you can have one or more cidr blocks of whatever sizes make sense for you. – BMitch Apr 27 '21 at 21:58
  • The most important part of this whole answer for me was the (now obvious) implication that "Bridge IP" means to enter a host IP instead of the network IP. Thank you for emphasizing that. It would be nice if the GUI could validate that param and reject it instead of waiting until a failed start and forcing a full config reset. – Todd Lyons Nov 17 '21 at 18:23
3

I use Docker Desktop in a Windows operating system and I tried to change the default Bridge IP.

Docker throws an error and asked me to reset the settings every time I tried to change just the bip in the settings.

This worked: (have to dive deep and understand how it works)

{
  "bip": "192.168.1.5/24", 
  "fixed-cidr": "192.168.1.5/25", 
  "default-address-pools":[
      { "base":"192.168.2.5/24", "size":28 }
  ]
}
StealthyDev
  • 31
  • 1
1

Configure the default bridge network: "… To configure the default bridge network, you specify options in daemon.json. Here is an example daemon.json with several options specified. Only specify the settings you need to customize. …"

With compose: Specify custom networks: "… Instead of just using the default app network, you can specify your own networks with the top-level networks key. This lets you create more complex topologies and specify custom network drivers and options. You can also use it to connect services to externally-created networks which aren’t managed by Compose. …"

poige
  • 9,171
  • 2
  • 24
  • 50
  • 1
    Is it possible to change the IP range used for implicit networks used by docker-compose, and ones that don't have the range set explicitly? – jrtapsell Jun 16 '18 at 13:09
-2

It might be a bit brutal but I simply do a sudo ifconfig docker0 down to shut down the interface that conflicts with the wifi I'm trying to use.

Falko Menge
  • 97
  • 1
  • The question is about using another range, not about turning off networking. – RalfFriedl Nov 29 '18 at 17:40
  • @RalfFriedl That is true. But as a frequent traveler who uses many different wifi networks, I have seen all sorts of port ranges being in conflict. So instead of searching for a port range, one can also temporarily turn off the network. – Falko Menge Nov 30 '18 at 22:03