flowchart TB
    subgraph API["API 层"]
        NetworkRouter[Network Router]
    end
    
    subgraph Core["libnetwork 核心"]
        Controller[Controller]
        NetworkStore[网络存储]
        SandboxMgr[Sandbox 管理器]
        EndpointMgr[Endpoint 管理器]
    end
    
    subgraph CNM["容器网络模型 CNM"]
        Network[Network 对象]
        Endpoint[Endpoint 对象]
        Sandbox[Sandbox 对象]
    end
    
    subgraph Drivers["网络驱动"]
        BridgeDriver[Bridge 驱动]
        OverlayDriver[Overlay 驱动]
        MacvlanDriver[Macvlan 驱动]
        HostDriver[Host 驱动]
        NullDriver[Null 驱动]
    end
    
    subgraph IPAM["IPAM 层"]
        IPAMDriver[IPAM 驱动]
        AddressSpace[地址空间]
        Pool[地址池]
    end
    
    subgraph Platform["平台层"]
        Netlink[Netlink]
        IPTables[iptables]
        NetNS[Network Namespace]
        VXLAN[VXLAN 隧道]
    end
    
    NetworkRouter --> Controller
    Controller --> NetworkStore
    Controller --> SandboxMgr
    Controller --> EndpointMgr
    
    NetworkStore --> Network
    Network --> Endpoint
    Endpoint --> Sandbox
    
    Network --> BridgeDriver
    Network --> OverlayDriver
    Network --> MacvlanDriver
    Network --> HostDriver
    Network --> NullDriver
    
    BridgeDriver --> IPAMDriver
    OverlayDriver --> IPAMDriver
    
    IPAMDriver --> AddressSpace
    AddressSpace --> Pool
    
    BridgeDriver --> Netlink
    BridgeDriver --> IPTables
    OverlayDriver --> VXLAN
    Sandbox --> NetNS

- **Endpoint**：网络端点，容器在网络中的接口

  ```go
  type Endpoint struct {
      id          string
      name        string
      network     *Network
      iface       *EndpointInterface  // IP/MAC 地址
      sandbox     *Sandbox
      portMapping []PortBinding
  }

**2. 网络驱动**：

- **Bridge 驱动**：
  - 创建 Linux 网桥（docker0）
  - 为容器创建 veth pair
  - 配置 iptables 规则（SNAT/DNAT）
  - 支持端口映射

- **Overlay 驱动**：
  - 基于 VXLAN 的跨主机网络
  - 分布式键值存储（etcd/consul）同步网络状态
  - VNI（VXLAN Network Identifier）隔离
  - 支持加密（IPsec）

- **Macvlan 驱动**：
  - 为容器分配物理网卡的 MAC 地址
  - 容器直接出现在物理网络
  - 无需 NAT，性能最佳
  - 需要网卡混杂模式

- **Host 驱动**：
  - 容器直接使用宿主机网络命名空间
  - 无网络隔离
  - 性能最佳

- **Null 驱动**：
  - 无网络配置
  - 仅 loopback 接口

**3. IPAM（IP 地址管理）**：

```go
type IPAM struct {
    defaultAddressSpace string  // "local" / "global"
    pools               map[string]*Pool
}

type Pool struct {
    subnet  *net.IPNet
    gateway net.IP
    allocated map[string]bool  // IP -> 是否已分配
}

sequenceDiagram
    autonumber
    participant Client as docker CLI
    participant Router as Network Router
    participant Controller as libnetwork Controller
    participant Network as Network 对象
    participant Driver as Bridge Driver
    participant IPAM as IPAM Driver
    participant Netlink as Netlink
    participant IPTables as iptables
    
    Note over Client: docker network create mynet
    Client->>Router: POST /networks/create
    Router->>Controller: CreateNetwork(name, driver, options)
    
    Note over Controller: 阶段1: 验证参数
    Controller->>Controller: 检查网络名是否已存在
    Controller->>Controller: 生成网络 ID
    
    Note over Controller: 阶段2: 分配 IP 地址空间
    Controller->>IPAM: RequestPool(subnet)
    IPAM->>IPAM: 分配子网 (默认 172.18.0.0/16)
    IPAM->>IPAM: 分配网关 (172.18.0.1)
    IPAM-->>Controller: Pool ID + 子网信息
    
    Note over Controller: 阶段3: 创建网络对象
    Controller->>Network: New(id, driver, ipamConfig)
    Network->>Driver: CreateNetwork(id, options, ipamData)
    
    Note over Driver: 阶段4: 创建网桥
    Driver->>Netlink: AddBridge("br-" + shortID)
    Netlink->>Netlink: 执行: ip link add br-abc type bridge
    Netlink-->>Driver: 网桥创建成功
    
    Driver->>Netlink: SetInterfaceUp("br-abc")
    Netlink->>Netlink: 执行: ip link set br-abc up
    
    Driver->>Netlink: AddIPAddress("br-abc", "172.18.0.1/16")
    Netlink->>Netlink: 执行: ip addr add 172.18.0.1/16 dev br-abc
    
    Note over Driver: 阶段5: 配置 iptables 规则
    Driver->>IPTables: EnsureChain("DOCKER-ISOLATION-STAGE-1")
    Driver->>IPTables: AddRule("-i br-abc ! -o br-abc -j DROP")
    Driver->>IPTables: AddRule("-o br-abc -j DOCKER")
    
    Driver-->>Network: 网络创建成功
    Network-->>Controller: Network 对象
    
    Controller->>Controller: 保存网络到存储
    Controller-->>Router: 网络 ID
    Router-->>Client: 201 Created
    
    Note over Client: docker run --network mynet --name web nginx
    Note over Client: (容器创建过程省略)
    
    Note over Client: 容器启动时连接网络
    Client->>Controller: ConnectContainerToNetwork(containerID, networkID)
    
    Note over Controller: 阶段6: 创建 Sandbox
    Controller->>Controller: GetSandbox(containerID)
    alt Sandbox 不存在
        Controller->>Controller: CreateSandbox(containerID)
        Controller->>Netlink: CreateNetworkNamespace(containerID)
        Netlink->>Netlink: 执行: ip netns add <container-id>
        Netlink-->>Controller: Namespace 路径
    end
    
    Note over Controller: 阶段7: 创建 Endpoint
    Controller->>Network: CreateEndpoint(name, options)
    Network->>IPAM: RequestAddress(poolID)
    IPAM->>IPAM: 分配 IP (172.18.0.2)
    IPAM-->>Network: IP 地址
    
    Network->>Driver: CreateEndpoint(endpointID, interface)
    
    Note over Driver: 阶段8: 创建 veth pair
    Driver->>Netlink: AddVethPair("veth" + shortID, "eth0")
    Netlink->>Netlink: 执行: ip link add vethXXX type veth peer name eth0
    Netlink-->>Driver: veth pair 创建成功
    
    Note over Driver: 阶段9: 连接 veth 到网桥
    Driver->>Netlink: SetMasterBridge("vethXXX", "br-abc")
    Netlink->>Netlink: 执行: ip link set vethXXX master br-abc
    
    Driver->>Netlink: SetInterfaceUp("vethXXX")
    
    Driver-->>Network: Endpoint 创建成功
    Network-->>Controller: Endpoint 对象
    
    Note over Controller: 阶段10: 连接 Endpoint 到 Sandbox
    Controller->>Network: Join(endpoint, sandbox)
    Network->>Driver: Join(endpoint, sandbox)
    
    Note over Driver: 阶段11: 移动 eth0 到容器命名空间
    Driver->>Netlink: SetNamespace("eth0", sandbox.Key)
    Netlink->>Netlink: 执行: ip link set eth0 netns <ns-path>
    
    Note over Driver: 阶段12: 配置容器内网络
    Driver->>Netlink: SetInterfaceIPAddress("eth0", "172.18.0.2/16")
    Netlink->>Netlink: (在容器 ns 内) ip addr add 172.18.0.2/16 dev eth0
    
    Driver->>Netlink: SetInterfaceUp("eth0")
    Netlink->>Netlink: ip link set eth0 up
    
    Driver->>Netlink: AddRoute(defaultRoute, gateway)
    Netlink->>Netlink: ip route add default via 172.18.0.1
    
    Note over Driver: 阶段13: 配置端口映射（如有）
    alt 配置了端口映射 -p 8080:80
        Driver->>IPTables: AddPortMapping(hostPort, containerIP, containerPort)
        IPTables->>IPTables: iptables -t nat -A DOCKER -p tcp --dport 8080 -j DNAT --to-destination 172.18.0.2:80
        IPTables->>IPTables: iptables -t filter -A DOCKER -d 172.18.0.2 -p tcp --dport 80 -j ACCEPT
    end
    
    Driver-->>Network: Join 成功
    Network-->>Controller: 连接成功
    Controller-->>Client: 网络连接完成
    
    Note over Client: 容器网络配置完成

# 实际执行的命令
ip link add br-abc123 type bridge
ip link set br-abc123 up
ip addr add 172.18.0.1/16 dev br-abc123

# 网络隔离规则
iptables -t filter -N DOCKER-ISOLATION-STAGE-1
iptables -t filter -A DOCKER-ISOLATION-STAGE-1 -i br-abc123 ! -o br-abc123 -j DOCKER-ISOLATION-STAGE-2
iptables -t filter -A DOCKER-ISOLATION-STAGE-2 -o br-abc123 -j DROP

# SNAT 规则（容器访问外网）
iptables -t nat -A POSTROUTING -s 172.18.0.0/16 ! -o br-abc123 -j MASQUERADE

# 转发规则
iptables -t filter -A FORWARD -i br-abc123 ! -o br-abc123 -j ACCEPT
iptables -t filter -A FORWARD -o br-abc123 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

# 创建网络命名空间
ip netns add <container-id>

# 命名空间路径
/var/run/docker/netns/<container-id>

# 创建 veth pair
ip link add veth123abc type veth peer name eth0

# 连接 veth 到网桥
ip link set veth123abc master br-abc123
ip link set veth123abc up

# 移动 eth0 到容器命名空间
ip link set eth0 netns /var/run/docker/netns/<container-id>

# 在容器命名空间内配置
ip netns exec <container-id> ip addr add 172.18.0.2/16 dev eth0
ip netns exec <container-id> ip link set eth0 up
ip netns exec <container-id> ip route add default via 172.18.0.1

# DNAT 规则（外部访问容器）
iptables -t nat -A DOCKER -p tcp --dport 8080 -j DNAT --to-destination 172.18.0.2:80

# FILTER 规则（允许流量）
iptables -t filter -A DOCKER -d 172.18.0.2/32 -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

sequenceDiagram
    autonumber
    participant App as 容器应用
    participant DNS as Docker DNS
    participant Store as 网络存储
    participant External as 外部 DNS
    
    App->>DNS: 查询 web.mynet
    DNS->>Store: 查找容器名 "web"
    alt 容器在同一网络
        Store-->>DNS: IP 地址 172.18.0.2
        DNS-->>App: A 记录 172.18.0.2
    else 容器不在同一网络
        DNS-->>App: NXDOMAIN
    end
    
    App->>DNS: 查询 www.google.com
    DNS->>DNS: 非容器名，转发查询
    DNS->>External: 递归查询
    External-->>DNS: IP 地址
    DNS-->>App: A 记录

// 容器 /etc/resolv.conf
nameserver 127.0.0.11  // Docker DNS 服务器
options ndots:0

// DNS 服务器监听地址
/var/run/docker/netns/<container-id>/resolv.conf

# 使用 iptables-restore 批量加载规则（比逐条添加快 10 倍）
iptables-save > /tmp/rules.txt
# 编辑规则...
iptables-restore < /tmp/rules.txt

# 使用 nftables 替代 iptables（更高性能）
dockerd --iptables-backend=nft

// 缓存打开的命名空间文件描述符
type NSCache struct {
    cache map[string]*os.File
    mu    sync.RWMutex
}

func (c *NSCache) Get(path string) (*os.File, error) {
    c.mu.RLock()
    if fd, ok := c.cache[path]; ok {
        c.mu.RUnlock()
        return fd, nil
    }
    c.mu.RUnlock()
    
    fd, err := os.Open(path)
    c.mu.Lock()
    c.cache[path] = fd
    c.mu.Unlock()
    return fd, err
}

# 生产环境推荐使用自定义网络（支持 DNS 解析）
docker network create \
  --driver bridge \
  --subnet 10.0.1.0/24 \
  --gateway 10.0.1.1 \
  --opt com.docker.network.bridge.name=mybr0 \
  mynet

docker run --network mynet --name web nginx
docker run --network mynet --name app myapp
# app 容器可通过 "web" 名称访问 nginx

# 禁用容器间通信（ICC）
docker network create \
  --opt com.docker.network.bridge.enable_icc=false \
  isolated-net

# 仅通过端口映射暴露服务
docker run --network isolated-net -p 8080:80 nginx

# 创建加密的 overlay 网络
docker network create \
  --driver overlay \
  --opt encrypted=true \
  --subnet 10.0.9.0/24 \
  my-overlay

# 容器自动加入 overlay 网络
docker service create \
  --network my-overlay \
  --name web \
  nginx

# 禁用 userland-proxy（使用 hairpin NAT，性能更好）
{
  "userland-proxy": false
}

# 使用 host 网络（无网络隔离，性能最佳）
docker run --network host nginx

# 查看网络详情
docker network inspect mynet

# 查看容器网络配置
docker inspect web -f '{{json .NetworkSettings}}' | jq

# 进入容器网络命名空间
nsenter --net=/var/run/docker/netns/<container-id> bash

# 查看 iptables 规则
iptables -t nat -L DOCKER -n -v
iptables -t filter -L DOCKER -n -v

{
  "driver": ["bridge", "overlay"],
  "id": ["abc123"],
  "label": ["env=prod", "app!=test"],
  "name": ["mynet"],
  "scope": ["local", "swarm", "global"],
  "type": ["custom", "builtin"]
}

[
  {
    "Name": "bridge",
    "Id": "abc123def456...",
    "Created": "2023-01-01T00:00:00.000000000Z",
    "Scope": "local",
    "Driver": "bridge",
    "EnableIPv6": false,
    "IPAM": {
      "Driver": "default",
      "Config": [
        {
          "Subnet": "172.17.0.0/16",
          "Gateway": "172.17.0.1"
        }
      ]
    },
    "Internal": false,
    "Attachable": false,
    "Ingress": false,
    "Containers": {
      "container1_id": {
        "Name": "web",
        "EndpointID": "endpoint123...",
        "MacAddress": "02:42:ac:11:00:02",
        "IPv4Address": "172.17.0.2/16",
        "IPv6Address": ""
      }
    },
    "Options": {
      "com.docker.network.bridge.default_bridge": "true",
      "com.docker.network.bridge.enable_icc": "true",
      "com.docker.network.bridge.enable_ip_masquerade": "true",
      "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
      "com.docker.network.bridge.name": "docker0"
    },
    "Labels": {
      "maintainer": "admin"
    }
  }
]

// API Handler
func (n *networkRouter) getNetworksList(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    filterArgs, err := filters.FromJSON(r.Form.Get("filters"))
    
    filter, err := dnetwork.NewFilter(filterArgs)
    
    // API v1.28+ 返回 Summary 格式
    list, _ := n.cluster.GetNetworkSummaries(filter)
    
    // 合并本地网络
    localNetworks, err := n.backend.GetNetworkSummaries(filter)
    for _, network := range localNetworks {
        if !existsInList(list, network.ID) {
            list = append(list, network)
        }
    }
    
    return httputils.WriteJSON(w, http.StatusOK, list)
}

// Backend Implementation
func (daemon *Daemon) GetNetworkSummaries(filter dnetwork.Filter) ([]network.Summary, error) {
    // 获取所有网络
    networks := daemon.netController.Networks()
    
    // 应用过滤器
    filtered := filterNetworks(networks, filter)
    
    // 转换为 Summary 格式
    summaries := make([]network.Summary, 0, len(filtered))
    for _, nw := range filtered {
        summaries = append(summaries, network.Summary{
            Name:       nw.Name(),
            ID:         nw.ID(),
            Created:    nw.Info().Created(),
            Scope:      nw.Info().Scope(),
            Driver:     nw.Type(),
            EnableIPv6: nw.Info().IPv6Enabled(),
            Internal:   nw.Info().Internal(),
            Attachable: nw.Info().Attachable(),
            Ingress:    nw.Info().Ingress(),
            IPAM:       buildIPAMConfig(nw),
            Labels:     nw.Info().Labels(),
        })
    }
    
    return summaries, nil
}

{
  "Name": "mynet",
  "Id": "abc123def456...",
  "Created": "2023-01-01T00:00:00.000000000Z",
  "Scope": "local",
  "Driver": "bridge",
  "EnableIPv6": false,
  "IPAM": {
    "Driver": "default",
    "Options": null,
    "Config": [
      {
        "Subnet": "172.18.0.0/16",
        "IPRange": "172.18.0.0/24",
        "Gateway": "172.18.0.1",
        "AuxiliaryAddresses": {}
      }
    ]
  },
  "Internal": false,
  "Attachable": false,
  "Ingress": false,
  "ConfigFrom": {
    "Network": ""
  },
  "ConfigOnly": false,
  "Containers": {
    "container1_id": {
      "Name": "web",
      "EndpointID": "endpoint123...",
      "MacAddress": "02:42:ac:12:00:02",
      "IPv4Address": "172.18.0.2/16",
      "IPv6Address": ""
    }
  },
  "Options": {
    "com.docker.network.bridge.enable_icc": "true",
    "com.docker.network.bridge.enable_ip_masquerade": "true"
  },
  "Labels": {},
  "Peers": [
    {
      "Name": "node1-abc123",
      "IP": "192.168.1.10"
    }
  ],
  "Services": {
    "service1_id": {
      "VIP": "10.0.0.2",
      "Ports": ["80/tcp"],
      "LocalLBIndex": 1,
      "Tasks": [
        {
          "Name": "service1.1",
          "EndpointID": "endpoint456...",
          "EndpointIP": "10.0.0.3",
          "Info": {
            "Host IP": "192.168.1.10"
          }
        }
      ]
    }
  }
}

// API Handler
func (n *networkRouter) getNetwork(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    term := vars["id"]
    
    verbose, _ := strconv.ParseBool(r.URL.Query().Get("verbose"))
    networkScope := r.URL.Query().Get("scope")
    
    // 首先按完整 ID 查找
    filterArgs := filters.NewArgs(filters.Arg("id", term))
    if networkScope != "" {
        filterArgs.Add("scope", networkScope)
    }
    
    filter, err := dnetwork.NewFilter(filterArgs)
    filter.IDAlsoMatchesName = true
    
    // 获取网络
    nw, err := n.backend.GetNetwork(term, verbose)
    if err != nil {
        // 尝试从 Swarm 获取
        nw, err = n.cluster.GetNetwork(term, verbose)
    }
    
    return httputils.WriteJSON(w, http.StatusOK, nw)
}

// Backend Implementation
func (daemon *Daemon) GetNetwork(name string, verbose bool) (network.Inspect, error) {
    nw, err := daemon.FindNetwork(name)
    if err != nil {
        return network.Inspect{}, err
    }
    
    // 基本信息
    inspect := network.Inspect{
        Name:       nw.Name(),
        ID:         nw.ID(),
        Created:    nw.Info().Created(),
        Scope:      nw.Info().Scope(),
        Driver:     nw.Type(),
        EnableIPv6: nw.Info().IPv6Enabled(),
        Internal:   nw.Info().Internal(),
        Attachable: nw.Info().Attachable(),
        Ingress:    nw.Info().Ingress(),
        IPAM:       buildIPAMConfig(nw),
        Options:    nw.Info().DriverOptions(),
        Labels:     nw.Info().Labels(),
    }
    
    // 添加已连接的容器
    inspect.Containers = make(map[string]network.EndpointResource)
    for _, ep := range nw.Endpoints() {
        container := daemon.getContainer(ep.Name())
        if container != nil {
            inspect.Containers[container.ID] = buildEndpointResource(ep)
        }
    }
    
    // 如果 verbose=true，添加服务信息
    if verbose {
        inspect.Services = buildServiceInfo(nw)
    }
    
    return inspect, nil
}

{
  "Name": "mynet",
  "CheckDuplicate": true,
  "Driver": "bridge",
  "EnableIPv6": false,
  "IPAM": {
    "Driver": "default",
    "Config": [
      {
        "Subnet": "172.18.0.0/16",
        "IPRange": "172.18.5.0/24",
        "Gateway": "172.18.0.1",
        "AuxiliaryAddresses": {
          "router": "172.18.0.254"
        }
      }
    ],
    "Options": {}
  },
  "Internal": false,
  "Attachable": false,
  "Ingress": false,
  "ConfigOnly": false,
  "ConfigFrom": {
    "Network": ""
  },
  "Options": {
    "com.docker.network.bridge.enable_icc": "true",
    "com.docker.network.bridge.enable_ip_masquerade": "true",
    "com.docker.network.driver.mtu": "1500"
  },
  "Labels": {
    "env": "production"
  }
}

{
  "Id": "abc123def456...",
  "Warning": ""
}

// API Handler
func (n *networkRouter) postNetworkCreate(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    var create network.CreateRequest
    if err := httputils.ReadJSON(r, &create); err != nil {
        return err
    }
    
    // 检查 Swarm 网络名称冲突
    if nws, err := n.cluster.GetNetworksByName(create.Name); err == nil && len(nws) > 0 {
        return libnetwork.NetworkNameError(create.Name)
    }
    
    // 创建网络
    nw, err := n.backend.CreateNetwork(ctx, create)
    if err != nil {
        // 如果是 Swarm 网络，转发到 Swarm Manager
        if _, ok := err.(libnetwork.ManagerRedirectError); ok {
            id, err := n.cluster.CreateNetwork(create)
            nw = &network.CreateResponse{ID: id}
        } else {
            return err
        }
    }
    
    return httputils.WriteJSON(w, http.StatusCreated, nw)
}

// Backend Implementation
func (daemon *Daemon) CreateNetwork(ctx context.Context, create network.CreateRequest) (*network.CreateResponse, error) {
    // 1. 验证网络名称
    if err := validateNetworkName(create.Name); err != nil {
        return nil, err
    }
    
    // 2. 检查名称冲突
    if create.CheckDuplicate {
        if _, err := daemon.FindNetwork(create.Name); err == nil {
            return nil, libnetwork.NetworkNameError(create.Name)
        }
    }
    
    // 3. 构建网络配置
    networkOptions := []libnetwork.NetworkOption{
        libnetwork.NetworkOptionEnableIPv6(create.EnableIPv6),
        libnetwork.NetworkOptionDriverOpts(create.Options),
        libnetwork.NetworkOptionLabels(create.Labels),
        libnetwork.NetworkOptionIpam(create.IPAM.Driver, "", create.IPAM.Config, create.IPAM.Options),
    }
    
    if create.Internal {
        networkOptions = append(networkOptions, libnetwork.NetworkOptionInternalNetwork())
    }
    
    if create.Attachable {
        networkOptions = append(networkOptions, libnetwork.NetworkOptionAttachable(true))
    }
    
    // 4. 创建网络
    nw, err := daemon.netController.NewNetwork(
        create.Driver,
        create.Name,
        "",
        networkOptions...,
    )
    if err != nil {
        return nil, err
    }
    
    // 5. 记录事件
    daemon.LogNetworkEvent(nw, "create")
    
    return &network.CreateResponse{
        ID:      nw.ID(),
        Warning: "",
    }, nil
}

{
  "Options": {
    "com.docker.network.bridge.name": "mybr0",
    "com.docker.network.bridge.enable_icc": "true",
    "com.docker.network.bridge.enable_ip_masquerade": "true",
    "com.docker.network.bridge.host_binding_ipv4": "0.0.0.0",
    "com.docker.network.driver.mtu": "1500"
  }
}

{
  "Options": {
    "com.docker.network.driver.overlay.vxlanid_list": "4096",
    "encrypted": "true"
  }
}

{
  "Container": "web",
  "EndpointConfig": {
    "IPAMConfig": {
      "IPv4Address": "172.18.0.10",
      "IPv6Address": "",
      "LinkLocalIPs": []
    },
    "Links": ["db:database"],
    "Aliases": ["webserver", "api"],
    "NetworkID": "",
    "EndpointID": "",
    "Gateway": "",
    "IPAddress": "",
    "IPPrefixLen": 0,
    "IPv6Gateway": "",
    "GlobalIPv6Address": "",
    "GlobalIPv6PrefixLen": 0,
    "MacAddress": "",
    "DriverOpts": {}
  }
}

// API Handler
func (n *networkRouter) postNetworkConnect(ctx context.Context, w http.ResponseWriter, r *http.Request) error {
    var connect networkbackend.ConnectOptions
    if err := httputils.ReadJSON(r, &connect); err != nil {
        return err
    }
    
    return n.backend.ConnectContainerToNetwork(ctx, connect.Container, vars["id"], connect.EndpointConfig)
}

// Backend Implementation
func (daemon *Daemon) ConnectContainerToNetwork(ctx context.Context, containerName, networkName string, endpointConfig *network.EndpointSettings) error {
    // 1. 获取容器
    container, err := daemon.GetContainer(containerName)
    if err != nil {
        return err
    }
    
    // 2. 获取网络
    nw, err := daemon.FindNetwork(networkName)
    if err != nil {
        return err
    }
    
    // 3. 检查容器状态
    if !container.IsRunning() {
        return errNotRunning(container.ID)
    }
    
    // 4. 检查是否已连接
    if container.NetworkSettings.Networks[nw.Name()] != nil {
        return nil // 幂等
    }
    
    // 5. 构建端点配置
    epConfig := &libnetwork.EndpointConfig{
        Name:          nw.Name(),
        Aliases:       endpointConfig.Aliases,
        DriverOpts:    endpointConfig.DriverOpts,
    }
    
    if endpointConfig.IPAMConfig != nil {
        epConfig.IPAMConfig = &libnetwork.IPAMConfig{
            IPv4Address: endpointConfig.IPAMConfig.IPv4Address,
            IPv6Address: endpointConfig.IPAMConfig.IPv6Address,
        }
    }
    
    // 6. 创建端点
    ep, err := nw.CreateEndpoint(container.Name, epConfig)
    if err != nil {
        return err
    }
    
    // 7. 加入网络沙箱
    sb := container.NetworkSettings.SandboxID
    if sb != "" {
        if err := ep.Join(sb); err != nil {
            nw.DeleteEndpoint(ep.ID())
            return err
        }
    }
    
    // 8. 更新容器配置
    container.NetworkSettings.Networks[nw.Name()] = buildEndpointSettings(ep)
    container.ToDisk()
    
    // 9. 记录事件
    daemon.LogNetworkEvent(nw, "connect", map[string]string{
        "container": container.ID,
    })
    
    return nil
}

{
  "Container": "web",
  "Force": false
}

// Backend Implementation
func (daemon *Daemon) DisconnectContainerFromNetwork(containerName string, networkName string, force bool) error {
    container, err := daemon.GetContainer(containerName)
    nw, err := daemon.FindNetwork(networkName)
    
    // 检查是否已连接
    if container.NetworkSettings.Networks[nw.Name()] == nil {
        return nil // 幂等
    }
    
    // 获取端点
    ep, err := container.GetEndpointInNetwork(nw)
    if err != nil && !force {
        return err
    }
    
    // 离开沙箱
    if ep != nil {
        if err := ep.Leave(container.NetworkSettings.SandboxID); err != nil && !force {
            return err
        }
        
        // 删除端点
        if err := nw.DeleteEndpoint(ep.ID()); err != nil && !force {
            return err
        }
    }
    
    // 更新容器配置
    delete(container.NetworkSettings.Networks, nw.Name())
    container.ToDisk()
    
    return nil
}

{
  "until": ["24h", "2023-01-01T00:00:00"],
  "label": ["env=test", "app!=prod"]
}

{
  "NetworksDeleted": [
    "mynet",
    "testnet"
  ],
  "SpaceReclaimed": 0
}

func (daemon *Daemon) NetworksPrune(ctx context.Context, pruneFilters filters.Args) (*network.PruneReport, error) {
    until, _ := filters.GetUntilTimestamp(pruneFilters)
    
    networks := daemon.netController.Networks()
    
    var networkNames []string
    for _, nw := range networks {
        // 跳过预定义网络
        if nw.Info().Dynamic() == false {
            continue
        }
        
        // 检查是否有容器使用
        if len(nw.Endpoints()) > 0 {
            continue
        }
        
        // 检查时间过滤
        if !until.IsZero() && nw.Info().Created().After(until) {
            continue
        }
        
        // 检查标签过滤
        if !pruneFilters.MatchKVList("label", nw.Info().Labels()) {
            continue
        }
        
        // 删除网络
        if err := daemon.DeleteNetwork(nw.ID()); err != nil {
            continue
        }
        
        networkNames = append(networkNames, nw.Name())
    }
    
    return &network.PruneReport{
        NetworksDeleted: networkNames,
    }, nil
}

# 创建 bridge 网络
curl -X POST http://localhost/v1.43/networks/create \
  -H "Content-Type: application/json" \
  -d '{
    "Name": "mynet",
    "Driver": "bridge",
    "IPAM": {
      "Config": [
        {
          "Subnet": "172.18.0.0/16",
          "Gateway": "172.18.0.1"
        }
      ]
    }
  }'

# 连接容器
curl -X POST http://localhost/v1.43/networks/mynet/connect \
  -H "Content-Type: application/json" \
  -d '{
    "Container": "web",
    "EndpointConfig": {
      "IPAMConfig": {
        "IPv4Address": "172.18.0.10"
      },
      "Aliases": ["webserver"]
    }
  }'

# 列出所有网络
curl http://localhost/v1.43/networks

# 过滤 bridge 驱动的网络
curl "http://localhost/v1.43/networks?filters=%7B%22driver%22%3A%5B%22bridge%22%5D%7D"

classDiagram
    class Controller {
        -string id
        -drvregistry.Networks drvRegistry
        -drvregistry.IPAMs ipamRegistry
        -map~string,*Sandbox~ sandboxes
        -map~string,*Network~ networks
        -*datastore.Store store
        -*config.Config cfg
        +NewNetwork(driver, name, options) (*Network, error)
        +Networks() []*Network
        +NetworkByID(id) (*Network, error)
        +NetworkByName(name) (*Network, error)
        +NewSandbox(containerID, options) (*Sandbox, error)
        +GetSandbox(id) *Sandbox
        +Stop()
    }
    
    class Network {
        -string id
        -string name
        -string networkType
        -*Controller ctrlr
        -*networkStore store
        -map~string,*Endpoint~ endpoints
        -generic map[string]any
        -ipamType string
        -ipamOptions map[string]string
        -[]IpamConf ipamV4Config
        -[]IpamConf ipamV6Config
        -driver Driver
        -sync.Mutex mu
        +ID() string
        +Name() string
        +Type() string
        +CreateEndpoint(name, options) (*Endpoint, error)
        +Endpoints() []*Endpoint
        +EndpointByName(name) (*Endpoint, error)
        +EndpointByID(id) (*Endpoint, error)
        +Delete() error
        +Info() NetworkInfo
    }
    
    class Endpoint {
        -string id
        -string name
        -*Network network
        -*EndpointInfo epInfo
        -*Sandbox sandbox
        -map[string]any generic
        -sync.Mutex mu
        +ID() string
        +Name() string
        +Network() string
        +Join(sb *Sandbox, options) error
        +Leave(sb *Sandbox) error
        +Delete() error
        +Info() EndpointInfo
    }
    
    class Sandbox {
        -string id
        -string containerID
        -*Controller controller
        -*osl.Namespace osSbox
        -[]*Endpoint endpoints
        -map~string,int~ epPriority
        -*Resolver resolver
        -containerConfig config
        -sync.Mutex mu
        +ID() string
        +ContainerID() string
        +Key() string
        +Endpoints() []*Endpoint
        +EnableService() error
        +DisableService() error
        +Delete() error
    }
    
    class Driver {
        <<interface>>
        +NetworkAllocate(id, options, ipV4Data, ipV6Data) (map, error)
        +NetworkFree(id) error
        +CreateNetwork(id, options, nInfo, ipV4Data, ipV6Data) error
        +DeleteNetwork(id) error
        +CreateEndpoint(nid, eid, epInfo, options) error
        +DeleteEndpoint(nid, eid) error
        +EndpointOperInfo(nid, eid) (map, error)
        +Join(nid, eid, sboxKey, jinfo, options) error
        +Leave(nid, eid) error
        +Type() string
    }
    
    class NetworkInfo {
        <<interface>>
        +ID() string
        +Name() string
        +Scope() string
        +IPv6Enabled() bool
        +Internal() bool
        +Attachable() bool
        +Ingress() bool
        +IpamConfig() (string, map, []*IpamConf, []*IpamConf)
        +IpamInfo() []*IpamInfo
        +DriverOptions() map[string]string
        +Labels() map[string]string
        +Peers() []networkdb.PeerInfo
        +Created() time.Time
    }
    
    class EndpointInfo {
        <<interface>>
        +Iface() InterfaceInfo
        +Gateway() net.IP
        +GatewayIPv6() net.IP
        +LoadBalancer() []net.IP
    }
    
    class InterfaceInfo {
        <<interface>>
        +MacAddress() net.HardwareAddr
        +Address() *net.IPNet
        +AddressIPv6() *net.IPNet
    }
    
    class IpamConf {
        +string PreferredPool
        +string SubPool
        +string Gateway
        +map~string,string~ AuxAddresses
    }
    
    class IpamInfo {
        +*net.IPNet IPAMData
        +*net.IPNet Pool
        +net.IP Gateway
        +map~string,*net.IPNet~ AuxAddresses
    }
    
    class IPAM {
        <<interface>>
        +GetDefaultAddressSpaces() (string, string, error)
        +RequestPool(addressSpace, pool, subPool, options, v6) (string, *net.IPNet, map, error)
        +ReleasePool(poolID) error
        +RequestAddress(poolID, ip, options) (*net.IPNet, map, error)
        +ReleaseAddress(poolID, ip) error
    }
    
    Controller "1" *-- "*" Network : manages
    Controller "1" *-- "*" Sandbox : manages
    Network "1" *-- "*" Endpoint : contains
    Endpoint "*" --> "0..1" Sandbox : joins
    Network --> Driver : uses
    Network ..> NetworkInfo : implements
    Endpoint ..> EndpointInfo : implements
    Network --> IPAM : uses

type Controller struct {
    // 唯一标识
    id string // Controller ID
    
    // 驱动注册表
    drvRegistry  drvregistry.Networks    // 网络驱动注册表
    ipamRegistry drvregistry.IPAMs       // IPAM 驱动注册表
    pmRegistry   drvregistry.PortMappers // 端口映射器注册表
    
    // 网络与沙箱
    networks  map[string]*Network  // 网络映射（ID → Network）
    sandboxes map[string]*Sandbox  // 沙箱映射（ID → Sandbox）
    
    // 持久化存储
    store *datastore.Store // 数据存储
    
    // 配置
    cfg *config.Config // 控制器配置
    
    // Swarm 相关
    agent           *nwAgent        // Swarm 网络代理
    ingressSandbox  *Sandbox        // Ingress 沙箱
    serviceBindings map[serviceKey]*service // 服务绑定
    svcRecords      map[string]*svcInfo     // 服务记录
    
    // 并发控制
    mu           sync.Mutex      // 全局锁
    networksMu   sync.Mutex      // 网络映射锁
    networkLocker *locker.Locker // 网络级锁
}

// 网络管理
func (c *Controller) NewNetwork(networkType, name string, id string, options ...NetworkOption) (*Network, error)
func (c *Controller) Networks() []*Network
func (c *Controller) NetworkByID(id string) (*Network, error)
func (c *Controller) NetworkByName(name string) (*Network, error)

// 沙箱管理
func (c *Controller) NewSandbox(containerID string, options ...SandboxOption) (*Sandbox, error)
func (c *Controller) GetSandbox(id string) *Sandbox
func (c *Controller) SandboxByID(id string) *Sandbox

// 控制器生命周期
func (c *Controller) Stop()
func (c *Controller) StartDiagnostic(port int)

// 驱动管理
func (c *Controller) RegisterDriver(networkType string, driver Driver, capability Capability) error
func (c *Controller) RegisterIpamDriver(name string, ipam IPAM) error