--disable-dns¶

Disables the DNS plugin for this network which if enabled, can perform container to container name resolution. It is only supported with the bridge driver, for other drivers it is always disabled.

--dns=ip¶

Set network-scoped DNS resolver/nameserver for containers in this network. If not set, the host servers from /etc/resolv.conf is used. It can be overwritten on the container level with the podman run/create --dns option. This option can be specified multiple times to set more than one IP.

--driver, -d=driver¶

Driver to manage the network. Currently bridge, macvlan and ipvlan are supported. Defaults to bridge. As rootless the macvlan and ipvlan driver have no access to the host network interfaces because rootless networking requires a separate network namespace.

The netavark backend allows the use of so called netavark plugins, see the plugin-API.md documentation in netavark. The binary must be placed in a specified directory so podman can discover it, this list is set in netavark_plugin_dirs in containers.conf(5) under the [network] section.

The name of the plugin can then be used as driver to create a network for your plugin. The list of all supported drivers and plugins can be seen with podman info --format {{.Plugins.Network}}.

Note that the macvlan and ipvlan drivers do not support port forwarding. Support for port forwarding with a plugin depends on the implementation of the plugin.

--gateway=ip¶

Define a gateway for the subnet. To provide a gateway address, a subnet option is required. Can be specified multiple times. The argument order of the --subnet, --gateway and --ip-range options must match.

--ignore¶

Ignore the create request if a network with the same name already exists instead of failing. Note, trying to create a network with an existing name and different parameters does not change the configuration of the existing one.

--interface-name=name¶

This option maps the network_interface option in the network config, see podman network inspect. Depending on the driver, this can have different effects; for bridge, it uses the bridge interface name. For macvlan and ipvlan, it is the parent device on the host. It is the same as --opt parent=....

--internal¶

Restrict external access of this network when using a bridge network. Note when using the CNI backend DNS will be automatically disabled, see --disable-dns.

When using the macvlan or ipvlan driver with this option no default route will be added to the container. Because it bypasses the host network stack no additional restrictions can be set by podman and if a privileged container is run it can set a default route themselves. If this is a concern then the container connections should be blocked on your actual network gateway.

--ip-range=range¶

Allocate container IP from a range. The range must be a either a complete subnet in CIDR notation or be in the <startIP>-<endIP> syntax which allows for a more flexible range compared to the CIDR subnet. The ip-range option must be used with a subnet option. Can be specified multiple times. The argument order of the --subnet, --gateway and --ip-range options must match.

--ipam-driver=driver¶

Set the ipam driver (IP Address Management Driver) for the network. When unset podman chooses an ipam driver automatically based on the network driver.

Valid values are:

View the driver in the podman network inspect output under the ipam_options field.

--ipv6¶

Enable IPv6 (Dual Stack) networking. If no subnets are given, it allocates an ipv4 and an ipv6 subnet.

--label=label¶

Set metadata for a network (e.g., --label mykey=value).

--opt, -o=option¶

Set driver specific options.

All drivers accept the mtu, metric, no_default_route and options.

Additionally the bridge driver supports the following options:

The macvlan and ipvlan driver support the following options:

Additionally the macvlan driver supports the bclim option:

--route=route¶

A static route in the format <destination in CIDR notation>,<gateway>,<route metric (optional)>. This route will be added to every container in this network. Only available with the netavark backend. It can be specified multiple times if more than one static route is desired.

--subnet=subnet¶

The subnet in CIDR notation. Can be specified multiple times to allocate more than one subnet for this network. The argument order of the --subnet, --gateway and --ip-range options must match. This is useful to set a static ipv4 and ipv6 subnet.