Docker

Docker macvlan gives containers their own MAC address and IP address on your physical network, eliminating the need for NAT or port mapping. It’s most useful when a container needs to appear as a real device on a specific subnet — common for Wake-on-LAN tools, network scanners, and IoT management containers that need to be on a dedicated VLAN.

Not by default. Macvlan isolates the container from the host at the network level, so the container can talk to other devices on the VLAN but not the machine it’s running on. To work around this, you can create a macvlan interface on the host side as well (sometimes called a shim interface), which gives the host an IP on the macvlan network.

With bridge networking, containers share the host’s IP and use NAT to reach the outside world. With macvlan, each container gets its own IP directly on your physical network — no NAT, no port forwarding. Macvlan behaves more like adding a new device to your network, while bridge networking behaves more like a software router sitting between the container and your LAN.

The most likely cause is a VLAN tagging gap somewhere in the chain. Check that: (1) the VLAN subinterface on the host is up (ip link show), (2) the Docker macvlan network is using the subinterface as parent — not the raw physical interface, (3) the upstream switch port is configured as a trunk that allows your VLAN, and (4) the IP you assigned isn’t conflicting with another device on that VLAN.