172.17.0.0/16: Docker's Default Bridge

When Docker starts, it creates the docker0 bridge with 172.17.0.0/16. The host is 172.17.0.1 and containers on the default bridge get 172.17.0.2, .3 and so on.

172.17.0.0/16 at a glance

Address range
172.17.0.0 – 172.17.255.255
Usable hosts
65,534
Total addresses
65,536
First usable
172.17.0.1
Last usable
172.17.255.254
Subnet mask
255.255.0.0
Wildcard mask
0.0.255.255
Type
Private (RFC 1918)

Is an address inside 172.17.0.0/16?

Yes — 172.17.0.2 is inside 172.17.0.0/16. It is address number 2 in the block (counting from 0).

What 172.17.0.0/16 is

It is a /16 inside the private range 172.16.0.0/12. Docker installs a route for it on the host, so anything addressed to 172.17.x.x goes to the bridge, not to your normal gateway.

New user-defined networks (and each docker compose project) get the next free /16: 172.18.0.0/16, 172.19.0.0/16 and so on.

Who uses it

  • Every Docker host

    Laptops, CI runners and servers running Docker with default settings.

  • Corporate networks that picked 172.17

    Some companies and VPN providers use 172.17.x.x or nearby /16s, which is where the trouble starts.

Conflicts and gotchas

  • Unreachable corporate hosts. If a server at 172.17.5.10 is on your office network, a laptop running Docker sends that traffic into docker0 instead. Symptoms: "works with Docker stopped".
  • The fix. Set "bip": "10.200.0.1/24" and "default-address-pools" in /etc/docker/daemon.json to a range nobody uses, then restart Docker.
  • Check first. List your VPN, office and cloud ranges and run them through the overlap checker before choosing new Docker pools.

How to split 172.17.0.0/16

Worked example: into /24s

  1. Going from /16 to /24 borrows 24 − 16 = 8 bits from the host part.
  2. Each borrowed bit doubles the number of subnets: 28 = 256 subnets.
  3. Each /24 keeps 32 − 24 = 8 host bits: 28 = 256 addresses, so 254 usable after removing network and broadcast.
  4. The new mask is 255.255.255.0, so subnets step by 1 in the third octet: 172.17.0.0/24, 172.17.1.0/24, 172.17.2.0/24 … up to 172.17.255.0/24.
Ways to split 172.17.0.0/16
Split into Subnets Usable each First blocks Good for
/24 256 254 172.17.0.0/24, 172.17.1.0/24, … 256 /24s — a sensible size for a custom Docker bridge.
/20 16 4,094 172.17.0.0/20, 172.17.16.0/20, … Sixteen /20s for compose project networks.

172.17.0.0/16 FAQ

What is 172.17.0.1?

The Docker host's address on the default docker0 bridge. Containers use it as their gateway and can reach host services through it.

How do I change Docker's 172.17.0.0/16 network?

Edit /etc/docker/daemon.json, set "bip" (e.g. "10.200.0.1/24") and optionally "default-address-pools", then restart the Docker service.

Is 172.17.0.0/16 private?

Yes. It is inside 172.16.0.0/12, an RFC 1918 private range.

Related tools

CIDR to IP Range Every address in 172.17.0.0/16 CIDR Calculator Split 172.17.0.0/16 into any size Subnet Overlap Checker Check it against your other ranges VLSM Calculator Split it into different-sized subnets /16 explained Mask, block size and maths for any /16

Other well-known networks: 10.0.0.0/24, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 192.168.0.0/24, 192.168.1.0/24 · all networks