I've had the same struggle. I'm moving my network to use a vxlan overlay for VMs so I ended up building a vxlan driver for docker networking which lets me do th

I've had the same struggle. I'm moving my network to use a vxlan overlay for VMs so I ended up building a vxlan driver for docker networking which lets me do the same thing for containers. That project is here: https://github.com/clinta/docker-vxlan-plugin https://github.com/clinta/docker-vxlan-plugin Docker seems really intent on NATing containers behind the host, which IMO is not acceptable from a security perspective when I want to firewall outbound access based on a containers role. Kubernetes is another option which creates a unique IP per container pod on the same network as the host. Not as flexible as a vxlan approach where containers can be micro-segmented into specific networks, but more like BSD jails that you're used to.