Our integration host is a virtual machine in our data centre that runs one Docker Compose project per partner adapter: carriers, two marketplaces, our payment provider's settlement files. In October it ran eleven of them. One carrier, which we reach through a site to site VPN, sits at 172.25.10.0/24, and our firewall routes that range into the tunnel. The host knows nothing about the VPN. It sends everything that is not local to its default gateway.

On a Tuesday afternoon we deployed a twelfth adapter, for a new returns partner. Twenty minutes later the carrier adapter was logging connection timeouts on every booking, and the firewall showed no traffic for the tunnel at all.

Every Compose project gets its own bridge network unless told otherwise, and Docker chooses its subnet from a default list of pools: 172.17.0.0/16 for the default bridge, then 172.18.0.0/16 through 172.31.0.0/16, then slices of 192.168.0.0/16. It takes the first one that no other Docker network on the host is using.…