全局视图

Docker 网络不是一坨代码，而是三层职责完全分离的设计。理解这三层的边界，后续看任何网络相关的代码都不会迷失。

痛点：很多开发者在调试容器网络时只看到错误信息，却找不到是 API 层、wrapper 层还是底层驱动出了问题。

┌─────────────────────────────────────────────────────────────────────┐
│ REST API 层 POST /networks/create "driver=bridge&name=foo" │
└──────────────────────────┬──────────────────────────────────────────┘
│
┌──────────────────────────▼──────────────────────────────────────────┐
│ 第 1 层 daemon/network │
│ - DefaultNetwork = "bridge" / "nat" │
│ - IsPredefined 判断 none/host/bridge/default 等是否内置 │
│ - Filter 把 docker network ls --filter 'driver=bridge' 解析出来 │
└──────────────────────────┬──────────────────────────────────────────┘
│
┌──────────────────────────▼──────────────────────────────────────────┐
│ 第 2 层 daemon.Daemon │
│ - Daemon.netController 字段持有 *libnetwork.Controller │
│ - Daemon.CreateNetwork → daemon.createNetwork │
│ · 校验 IsPredefined │
│ · 注入 daemon.json 里的 DefaultNetworkOpts │
│ · 解析 enableIPv4/enableIPv6 等 bool 字段 │
│ · 把 CreateRequest 翻译成 libnetwork.NetworkOption │
│ · 调用 c.NewNetwork │
│ · pluginRefCount 维护插件引用计数 │
│ · 发 events.ActionCreate 事件 │
│ - Daemon.FindNetwork / GetNetworkByID / GetNetworkByName │
│ │
│ - Daemon.DeleteNetwork / ConnectContainerToNetwork ... │
│ - buildNetworkResource / buildContainerAttachments 把 libnetwork │
│ 对象反向序列化成 API 返回的 networktypes.Network │
└──────────────────────────┬──────────────────────────────────────────┘
│
┌──────────────────────────▼──────────────────────────────────────────┐
│ 第 3 层 libnetwork.Controller │
│ - drvRegistry: 持有 bridge/host/ipvlan/macvlan/null/overlay 驱动 │
│ - ipamRegistry: 持有 IPAM 驱动 │
│ - pmRegistry: 端口映射器 │
│ - networks / endpoints / sandboxes 三张内存表 │

一次 docker network create -d bridge mynet 的完整旅程

1. CLI/REST:POST /networks/create body {Name:"mynet",Driver:"bridge"}。
2. router/server 路由到 daemon/server/daemon.go 里注册的 handler。
3. handler 调用 backend.CreateNetwork,即 Daemon.CreateNetwork。怎么说呢，
4. Daemon.CreateNetwork 包一层 runInNetNS接下来调真正的 daemon.createNetwork。
5. createNetwork 干 件事:
   • network.IsPredefined 拦掉 none/host/bridge 等保留字；
   • 默认 driver 用 C.Config.DefaultDriver
   • If overlay but not manager → Forbidden
   • 合并 Cfg.DefaultNetworkOpts；
   • 把 enableIPv4/IPv6,manual...
   • 调用 C.NewNetwork
6. The libnetwork.NewNetwork flow:
   • L锁住 ID/name lock
   • L校验 scope、resolve driver、IPAM 分配子网、add network、持久化、join cluster、创建 LB sandbox等步骤。
7. L返回结果：*Network → wrapper 更新 plugin 引用计数 + 发 create event → API 返回 {ID: ...}.

阅读完这条链，你就能定位到底是哪个层次出现问题：

• If you see an error about “predefined network”,it’s coming from API layer.
• If you see “manager redirect” or “swarm scoped”,it’s wrapper layer.
• If you see driver‑specific errors like veth creation failure,it’s libnetwork layer.

第 1 层 daemon/network 包:API 语义层

This is smallest layer with just a few files but it defines “what” of Docker networking at API level.

network_mode.go:网站无关入口

// daemon/network/network_mode.goconst MainConstant = defaultNetwork// 网站相关。见 network_mode_unix.go / windows.gofunc IsPredefined bool { return isPreDefined}

The only two exported symbols are DefaultNetwork  and I​sPredefined. The implementation splits by platform:

network_mode_unix.go  vs network_mode_windows.go

go // daemon/network/networkmodeunix.goconst defaultNetwork = network.NetworkBridge // "bridge"

func isPreDefined bool { n := container.NetworkMode return n.IsBridge || n.IsHost || n.IsNone || n.IsDefault }

func isPreDefined bool { return!container.NetworkMode.IsUserDefined }

The Linux logic uses a whitelist while Windows uses a blacklist – both reflect different abstractions of what a “predefined” network means on each platform. The comment even hints at an upcoming alignment effort : check if we can align check for both platforms).

settings.go :container‑side 网络状态

The Settings /EndpointSettings ) :

go type Settings struct { SandboxID string SandboxKey string Networks map*EndpointSettings // network name → endpoint Service *clustertypes.ServiceConfig Ports networktypes.PortMap HasSwarmEndpoint bool } type EndpointSettings struct { *networktypes.EndpointSettings IPAMOperational bool // not persisted/exposed DesiredMacAddress networktypes.HardwareAddr }

This is a classic wrapper pattern – public fields come from networktypes.EndpointSettings 。while Docker needs two extra runtime‑only fields that are not part of public API.

filter.go : docker network ls --filter  实现

The filter type plus factory functions support seven dimensions – driver/name/id/label/scope/type/dangling/until – and define a FilterNetwork *libnetwork.Network . This creates a hidden coupling point 娱乐ween Layer 1 and Layer 2 – if Network changes its method set,filter will break.

第 2 章 daemon wrapper: 把 REST 翻译成 libnetwork 调用

The entry point is daemon/network.go** . This layer is thick in lines but thin in responsibility – pure translation 娱乐ween API types and libnetwork objects.

Persistent reference: Daemon.netController **** go // daemon/daemon.go: type Daemon struct { ... netController *libnetwork.Controller ... } // daemon/network.go: func NetworkController *libnetwork.Controller { return d.netController }

The controller field stays private – everything goes through Daemon methods except for core code paths that need direct sandbox access .