Docker / Networking, Ports & Service Connectivity
Explain host-to-container isolation on a macvlan network
A macvlan container can be reachable from other machines while the parent host cannot contact it through the expected path.
Environment and inputs: Docker Engine · Compose v2 and Buildx where specified; Linux containers unless noted. Verify daemon context, installed feature support and authorized host or Swarm manager access first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
docker network inspect --format '{{.Driver}} {{json .Options}} {{json .IPAM.Config}}' appnetRead the result
The metadata confirms whether macvlan and its intended parent are in use. Platform restrictions and host communication semantics need the driver's documented design.
Resolve and verify
Compare the approved host-access and physical-switch requirements with the workload path. Use a supported reviewed architecture for any required host communication.
Before changing production
Do not disable host network protections or add arbitrary interfaces to bypass a macvlan limitation.