Why Is My Docker Container on Dual Networks Misrouting Traffic to the Host?

I have a container named workload_container that is connected to two Docker networks, and I’m facing routing issues. One network is a bridge (test_bridge) used for container-to-container communication, and the other is a macvlan (amcnet) intended to assign a static LAN IP (e.g. 192.168.31.180) so that the container is accessible locally. However, there are two problems:

1. Docker does not guarantee a fixed network priority when binding multiple networks, causing unpredictable routing.
2. When connected to both networks, the container cannot ping the Host Machine’s LAN IP (192.168.31.74) until I manually add a route.

Setup and Networks

Container: workload_container
Host LAN IP: 192.168.31.74

Networks:

• test_bridge: a bridge network for resolving names between containers.
• amcnet: a macvlan network for assigning a static LAN IP (192.168.31.180) to the container.

Problem Details

• The default route selected by the container seems unreliable because Docker’s network binding order is not static.
• The container fails to ping the host’s LAN IP until a manual route is added, suggesting the macvlan network’s gateway (--gateway 192.168.31.1) isn’t enforced properly in the routing table.

Steps to Reproduce

1. Create test_bridge and amcnet Networks

docker network create test_bridge
docker network create \
 --driver macvlan \
 --subnet=192.168.31.0/24 \
 --gateway=192.168.31.1 \
 --opt parent=enp5s0 \
 amcnet

2. Prepare Dockerfile and Compose.yaml

• Dockerfile:

PYTHONCopied
FROM debian

RUN apt update && apt install net-tools iputils-ping -y

• compose.yaml:

YAMLCopied
services:
  network_test:
    build: .
    command: bash
    privileged: true
    networks:
      default:
      mcnet:
        ipv4_address: "192.168.31.180"
networks:
  default:
    external: true
    name: test_bridge
  mcnet:
    external: true
    name: amcnet

3. Build & Run the Container

Step 1: Ping the Host IP (192.168.31.74)

docker compose run \
 --rm \
 --build \
 --remove-orphans \
 network_test \
 /bin/bash -c "route && ping 192.168.31.74"

Output:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.31.1    0.0.0.0         UG    0      0        0 eth0
172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth1
192.168.31.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
PING 192.168.31.74 (192.168.31.74) 56(84) bytes of data.
From 192.168.31.180 icmp_seq=1 Destination Host Unreachable
...

Step 2: Manually add a route, then ping again

docker compose run \
 --rm \
 --build \
 --remove-orphans \
 network_test \
 /bin/bash -c "route add -net 192.168.31.0/24 gw 192.168.31.1 && route && ping 192.168.31.74"

Output:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.31.1    0.0.0.0         UG    0      0        0 eth0
172.19.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth1
192.168.31.0    192.168.31.1    255.255.255.0   UG    0      0        0 eth0
192.168.31.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
PING 192.168.31.74 (192.168.31.74) 56(84) bytes of data.
64 bytes from 192.168.31.74: icmp_seq=1 ttl=63 time=0.329 ms
...

Summary of the Issue

The key difference observed is in the routing table entry for 192.168.31.0/24:

192.168.31.0 192.168.31.1 255.255.255.0 UG 0 0 0 eth0

My questions are:

1. Why does the default route not behave as expected?
2. Why does Docker ignore the --gateway option on the macvlan network, leading to a route with a gateway of 0.0.0.0 (causing the container to reference its own IP 192.168.31.180)?

I’m seeking an explanation or workaround to have predictable routing when using both a bridge and a macvlan network. Any suggestions or configuration tips would be appreciated.