How do you prevent Docker network subnets from conflicting with VPNs and local networks?

For projects that need to communicate, create a shared Docker network explicitly and mark it as external in the Compose files that use it. Otherwise, let each Compose stack keep its own default network. This avoids manually assigning addresses while still giving you predictable network boundaries.

Port conflicts are a separate issue from subnet conflicts. Containers can use the same internal port on separate networks; conflicts only happen when multiple services bind the same host port. In that case, change the host-side port mapping or avoid publishing the port when only other containers need access.

You generally shouldn’t need to manage individual container IPs. Docker’s built-in IPAM is designed to assign those automatically. The important part is preventing Docker’s pool from overlapping with routes already present on the host. Once the global pool is placed in a safe range, let Compose create isolated project networks normally.

A practical fix is to reserve a private range for Docker that cannot overlap with your LAN or VPN, then configure Docker’s global address pools in /etc/docker/daemon.json. For example: {"bip":"10.200.0.1/24","default-address-pools":[{"base":"10.201.0.0/16","size":24}]}. The base is the larger block Docker can allocate from, while size controls the subnet assigned to each user-defined bridge network. A /24 is usually plenty for an individual Compose project. Restart Docker after changing the file, and make sure the chosen ranges are not used by any corporate VPN or local network.