172.17.0.0/16 — Docker's default bridge
If you run Docker, 172.17.0.0/16 exists on your machine whether you planned it or not. The daemon claims this 65,536-address range for its default bridge network the first time it starts, creating the docker0 interface at 172.17.0.1 and handing every container without explicit networking an address from the pool.
It was an arbitrary pick from the 172.16.0.0/12 private block — and arbitrary picks are exactly how you get the most famous subnet conflict in operations.
| Network address | 172.17.0.0 |
| Subnet mask | 255.255.0.0 |
| Wildcard mask | 0.0.255.255 |
| Broadcast address | 172.17.255.255 |
| First usable | 172.17.0.1 |
| Last usable | 172.17.255.254 |
| Total addresses | 65,536 |
| Usable hosts | 65,534 |
docker0 and the default bridge
Containers on the default bridge sit behind NAT: outbound traffic is masqueraded through the host, and inbound requires -p port publishing. It is fine for quick tests and poor for production — no built-in DNS between containers, everything sharing one network. Compose files and user-defined networks exist to get you off it.
The corp VPN collision, and the bip fix
The classic incident: your company already routes 172.17.0.0/16 — an office VLAN, a VPN pool — and the moment Docker starts, local routes shadow the corporate ones. Half your traffic to "the office" now flows into containers. The fix is one line in /etc/docker/daemon.json: set "bip": "192.168.255.1/24" (or any free range) to move the default bridge, then restart the daemon.
User-defined networks are a separate allocator: Docker hands them 172.18.0.0/16, 172.19.0.0/16 and so on, working upward — which is why the "Docker stole my subnet" story keeps recurring one /16 at a time. The default-address-pools daemon setting relocates those too.
CIDR Calculator
Run the math on 172.17.0.0/16 — or any other block
Frequently asked questions
Why do my Docker containers have 172.17.x.x addresses?
Docker's default bridge network is 172.17.0.0/16 with the host at 172.17.0.1 (docker0). Containers attached to it are NAT'd behind the host and reach the outside via masquerading.
Docker broke my VPN — what do I do?
The default bridge or a user-defined network overlaps your VPN's routes. Move Docker with the bip option (default bridge) and default-address-pools (user networks) in daemon.json, then restart the daemon.
What is the difference between 172.17 and 172.18 networks in Docker?
172.17.0.0/16 is the built-in default bridge. 172.18.0.0/16 and upward go to user-defined bridge networks (docker network create, Compose projects), which get container DNS and isolation.
Is 172.17.0.1 my router?
No — on a Docker host it is the docker0 bridge interface: the containers' gateway, owned by the Docker daemon. Your real LAN gateway is unaffected unless the ranges happen to collide.