I wrote a docker network plugin once which interfaced with a VDE virtual switch. The benefit was that the switch was user space and pipes based, so technically

I wrote a docker network plugin once which interfaced with a VDE virtual switch. The benefit was that the switch was user space and pipes based, so technically you could wire more things into it (like packet droppers) without messing with your hosts networking stack. The motivation was I wanted to use more easily customized dockerized services to test bare-metal system images boot process - which required a bunch of stuff (like DHCP, config management etc.) to be "available" on the network but more easily swapped out. This actually worked great! You could use QEMU to spin up a machine, have a DHCP container assign it an ethernet address but then reserve an IP range on the docker network for docker to launch containers into. It also meant you could bridge into the virtual network easily and without any host IP stack interactions - just launch an interactive container onto the network (or launch it with two interfaces, one on the "real" network so you could provide internet connectivity). I wanted to get around to testing failure states, but it never ultimately came up.