What are Docker address pools?

Every Docker network gets its own range of IP addresses, called a subnet. When you create a network without choosing a subnet, Docker takes one from a built-in list of address pools that starts with 172.17.0.0/16 and continues through 172.31.0.0/16 and 192.168.0.0/16. This works until the chosen range clashes with something else, such as a VPN, an office network, or a database that lives at a fixed address. To fix it for every network at once, you change the address pools in the Docker daemon settings.

Tool description

This tool generates the daemon.json settings that control which subnets Docker uses. Enter one or more address pool ranges and the size of each network to get the default-address-pools setting. You can also set the address of the default docker0 bridge with bip. The tool shows how many networks fit into your pools and how many hosts each network has, checks your input as you type, and flags ranges that are likely to cause conflicts. Everything is calculated in your browser.

Examples

Give all new networks a /24 out of 10.10.0.0/16, which makes room for 256 networks with 254 usable hosts each:

{
  "default-address-pools": [
    {
      "base": "10.10.0.0/16",
      "size": 24
    }
  ]
}

Move the default bridge to another range and use two pools:

{
  "bip": "10.200.0.1/24",
  "default-address-pools": [
    {
      "base": "10.10.0.0/16",
      "size": 24
    },
    {
      "base": "10.20.0.0/20",
      "size": 24
    }
  ]
}

Features

  • Several address pool ranges at once, one per line
  • The size of the networks that Docker cuts out of each pool
  • Optional address for the default docker0 bridge
  • Shows how many networks fit into the pools and how many usable hosts each network has
  • Warns about public ranges, overlapping pools, and addresses with host bits set
  • Download the result as daemon.json

How it works

A range is written as an address and a prefix length, for example 10.10.0.0/16. The prefix says how many of the 32 bits are the network part, and the rest count the hosts. Each pool has a base range and a network size. Docker splits the base into networks of that size and hands them out one by one, so a base of 10.10.0.0/16 with size 24 gives 2^(24 − 16) = 256 networks. A /24 network has 256 addresses, of which 254 are usable, because the first is the network address and the last is the broadcast address. Docker also uses the first usable address as the gateway of a bridge network.

The size cannot be smaller than the prefix of the base, and it is limited to /30, because a network needs room for a gateway and at least one container.

Tips

  • Pick ranges from 10.0.0.0/8 or 172.16.0.0/12 that your VPN and your office network do not use. Ranges near 192.168.0.0/16 are the most likely to clash, because home and office routers use them
  • The default docker0 bridge always takes 172.17.0.0/16. If that clashes with your network, set bip to another address, for example 10.200.0.1/24
  • Save the result as /etc/docker/daemon.json on Linux, or in Settings → Docker Engine in Docker Desktop, and restart Docker. Merge it with the settings that are already in the file instead of replacing them
  • A change of default-address-pools only affects networks that are created afterward. Remove and create the existing networks again to move them to the new range
  • Pools that overlap each other are hard to reason about, so keep them apart
  • When you see "all predefined address pools have been fully subnetted", Docker ran out of ranges. Add a larger base or a smaller network size to get more networks