Overlay Network ā Connecting Containers Across Multiple Hosts
What Is an Overlay Network in Simple Terms?
A bridge network connects containers on the same host. An overlay network connects containers across multiple hosts ā containers running on different physical or virtual machines communicate as if they are on the same local network, with Docker handling all the routing transparently.
Overlay networks use VXLAN (Virtual Extensible LAN) to encapsulate container traffic inside UDP packets that travel across the real network between hosts.
+------------------+ +------------------+| Host 1 | | Host 2 || | | || +----------+ | | +----------+ || | api | | | | worker | || | 10.0.0.2 | | | | 10.0.0.3 | || +-----+----+ | | +-----+----+ || | | | | || overlay network |=====>| overlay network || VXLAN tunnel | | VXLAN tunnel |+------------------+ +------------------+ api pings 10.0.0.3 -> VXLAN encapsulates -> travels across real network-> Host 2 decapsulates -> delivers to workerContainers see a flat network ā VXLAN is invisible to themCreating and Using Overlay Networks
# Overlay networks require Docker Swarm modedocker swarm init # Create an overlay networkdocker network create \ --driver overlay \ --attachable \ payment-overlay# --attachable: allows standalone containers (not just Swarm services) to join # Deploy a Swarm service on the overlay networkdocker service create \ --name payment-api \ --network payment-overlay \ registry.razorpay.in/payment-api:v3.1.0 # Services on the same overlay network find each other by service name# Docker's built-in load balancing distributes traffic across replicasEncrypted Overlay Networks
# Create encrypted overlay (traffic encrypted with AES-GCM)docker network create \ --driver overlay \ --opt encrypted \ --attachable \ secure-payment-overlay# All traffic between containers encrypted# Small performance overhead (~10%)Overlay vs Bridge ā When to Use Each
| Need | Bridge | Overlay |
|---|---|---|
| Single host containers | Yes | No need |
| Multiple hosts | Cannot | Yes |
| Docker Swarm services | No | Yes |
| Kubernetes (CNI) | No | Similar concept |
Connection to Kubernetes
Kubernetes CNI plugins (Calico, Cilium, Flannel) implement the same concept as Docker overlay networks ā containers on different nodes communicate as if on the same flat network. Understanding Docker overlay networks makes Kubernetes pod networking immediately intuitive.
REMEMBER THIS**Remember:** Overlay networks require Docker Swarm mode. If you are not using Swarm, you cannot create overlay networks ā use bridge networks for single-host and look at Kubernetes for multi-host orchestration.