How does traffic flow between containers and the outside world?

On a bridge network, each container gets a veth pair connected to a Linux bridge and an address in the bridge subnet. Outbound traffic is masqueraded to the host IP. Inbound traffic reaches a container only through a published port, which installs DNAT rules.

docker network inspect app-net
docker exec api-1 ip addr
docker exec api-1 cat /etc/resolv.conf
docker run --rm --network container:api-1 nicolaka/netshoot dig db

Modes and their trade-offs

• bridge: isolated subnet with NAT, the common default
• host: no network namespace, so the container shares host ports and interfaces
• overlay: VXLAN encapsulation across hosts, with extra MTU and latency overhead
• macvlan: a routable MAC and IP on the physical network, bypassing NAT
• none: no connectivity, useful for isolated processing

Overlay networks add encapsulation, so the underlay MTU must be large enough or large packets fragment or stall. This shows up as TLS handshakes or large uploads hanging while small requests work.