Docker subnet conflict checker
Enter your LAN and VPN ranges, or paste ip route output, and see which Docker networks would collide with them, and a pool that avoids them for daemon.json. Nothing you enter or paste leaves this page.
Nothing to check yet. Enter at least one range, or paste ip route or docker network inspect output.
What it does
It checks whether the networks Docker creates collide with the networks you use: your home LAN, a VPN, an office or a cloud VPC. When they do, traffic to those addresses goes into a container network instead of out to the real one, and services across the VPN or on the LAN become unreachable from the host or from containers.
How it works
- Docker creates networks from its built-in pools, 172.17.0.0/16 to 172.31.0.0/16 and then /20 networks of 192.168.0.0/16, or from default-address-pools in daemon.json. The check finds every Docker network that could land on one of your ranges.
- From ip route output it takes the host's own networks and the Docker bridges (docker0, br-…); from docker network inspect, the existing networks; from daemon.json, the pools and bip.
- It then suggests one pool and a bip outside all of them, which the generator writes into daemon.json. Everything runs in your browser with @anaroq/linux; nothing is sent, stored or put in a link, except the suggested pool when you open the generator.
Commands to paste here
ip route- The host's routes: LAN, VPN and Docker bridges.
docker network inspect $(docker network ls -q)- Every Docker network with its subnet.
sudo cat /etc/docker/daemon.json- Your current pools and bip, if any.
Example
A host on a 192.168.1.0/24 home LAN with a VPN on 10.8.0.0/24 and Docker's default settings. The LAN lies inside Docker's 192.168.0.0/16 pool:
default via 192.168.1.1 dev eth0 proto dhcp src 192.168.1.20 metric 100
10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.6
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.20 metric 100
192.168.1.0/24↔192.168.0.0/20(192.168.0.0/16)
Suggested for daemon.json:
{
"default-address-pools": [
{
"base": "10.200.0.0/16",
"size": 24
}
],
"bip": "10.199.0.1/24"
}
Limits
- IPv4 only for the pools. IPv6 routes are read but Docker's IPv6 pools are not checked.
- It reads what you paste at one moment: a VPN that connects later, or a network created later, is not in it.
- Docker Desktop and rootless Docker are not covered. Swarm overlay networks (default-addr-pool of docker swarm init) are not checked.
- It does not change networks. Moving an existing network means removing and recreating it.
Write the whole daemon.json, with log rotation, in the daemon.json generator
Sources
Related
Next step
A free public tool by ANAROQ, a company building compute infrastructure. What ANAROQ is building