It should be possible to create a network without assigning the bridge an IP address

Using the default bridge and IPAM drivers, it should be possible to create a bridge without assigning it an IP address. This is expressed at the gateway address through the CLI, and although I can set the gateway address within the subnet assigned to the network, there appears to be no way to specify that the bridge should not be assigned an IP address at all.

This is strange when considered in the context or isolated networks where there should be no connectivity outside the isolated network, and therefore no need for a gateway. This is important in the case of untrusted or possibly compromised containers on the isolated docker network, as the bridge address exposes host services. (i.e. if the host is running SSH, HTTP, or (god forbid) Docker listening over TCP without binding to a particular IP address, then these services will be accessible through the bridge IP, and open to compromise from an attacker)

What I'd like to see would be that if I specify a new flag (e.g. "--noip") or provide a special value (e.g. "0.0.0.0") to the "--gateway" flag when using the CLI "docker network create" command that it would create the bridge with no IP address. I am not familiar enough with the internal libnetwork APIs to know what it would be at this layer.

Any comments, pointers on how to implement this change, or workarounds, would be appreciated

Start with the docker network create CLI, especially the --gateway handling, then trace the corresponding libnetwork API and the default bridge and IPAM drivers. Done means an isolated bridge can be created without any bridge IP address while preserving normal network creation behavior; the issue does not name specific files or tests.