<p>Docker should avoid using a network if there's a route to that network (see <code>ip r</code>). You can whitelist networks that docker is allowed to use with configurations in several places:</p>

<ul>
<li>You can adjust <code>bip</code> in <code>/etc/docker/daemon.json</code> which controls the docker bridge network named bridge. This needs to be set to a gateway ip with CIDR notation.</li>
<li>You can adjust <code>default-address-pools</code> in <code>/etc/docker/daemon.json</code> which is a list of CIDR blocks for all other bridge networks.</li>
<li>You can pass <code>--default-addr-pool</code> when initializing a swarm to a CIDR block for overlay networks.</li>
</ul>

<p>Make sure the two pools are large enough to create multiple networks, e.g. a <code>/16</code> subnet to allow creation of 256 <code>/24</code> networks.</p>

<p>More details of this are available in my <a href="https://sudo-bmitch.github.io/presentations/dc2019/tips-and-tricks-of-the-captains.html#address-pools" rel="nofollow noreferrer">DockerCon presentation</a> (press <code>P</code> for presenter notes).</p>

CC BY-SA 4.0
2020-04-02T17:58:11.503Z
That is great knowledge. Thanks a lot!
Worp
CC BY-SA 4.0
2020-04-02T15:17:43.707Z
2020-04-02T15:17:43.707Z
BMitch
<p>Basically I need to blacklist an IP range (and maybe multiple ranges) so that Docker can use any other IPs for its containers BUT IPs in this range.</p>

<p>Assume I have my docker nodes in a swarm of n nodes. They are in IP range <code>10.1.1.0/24</code>. There are multiple other VMs in this IP range like a VPN Server, a firewall, etc.</p>

<p>Can I restrict Docker from assigning IPs from this range to containers it starts?</p>

<docker><networking><docker-daemon>
Blacklist network ranges Docker is allowed to use for its containers (swarm mode)
Worp
# Blacklist network ranges Docker is allowed to use for its containers (swarm mode)

(Asked by: username_0 on 2020-04-02)

Basically I need to blacklist an IP range (and maybe multiple ranges) so that Docker can use any other IPs for its containers BUT IPs in this range.

Assume I have my docker nodes in a swarm of n nodes. They are in IP range `10.1.1.0/24`. There are multiple other VMs in this IP range like a VPN Server, a firewall, etc.

Can I restrict Docker from assigning IPs from this range to containers it starts?

**Tags:** docker, networking, docker-daemon


---

## 1 answers

### Answer by username_1 on 2020-04-02. Score: 4 | Accepted answer

Docker should avoid using a network if there's a route to that network (see `ip r`). You can whitelist networks that docker is allowed to use with configurations in several places:

* You can adjust `bip` in `/etc/docker/daemon.json` which controls the docker bridge network named bridge. This needs to be set to a gateway ip with CIDR notation.
* You can adjust `default-address-pools` in `/etc/docker/daemon.json` which is a list of CIDR blocks for all other bridge networks.
* You can pass `--default-addr-pool` when initializing a swarm to a CIDR block for overlay networks.

Make sure the two pools are large enough to create multiple networks, e.g. a `/16` subnet to allow creation of 256 `/24` networks.

More details of this are available in my [DockerCon presentation](https://sudo-bmitch.github.io/presentations/dc2019/tips-and-tricks-of-the-captains.html#address-pools) (press `P` for presenter notes).

> **Comments:**
> **username_0**: That is great knowledge. Thanks a lot!  

---

