libnetwork forcing a bridge to have an address

Hi,

I am trying to setup docker to use externally provided bridge interface and IP addresses pool - no iptables, no docker0 interface - everything is done by the external firewall and the host should not be able to directly talk to containers. Docker should concentrate on running containers only.

Unfortunately, this is impossible - docker overwrites my setup (no ip address on the interface) and assigns one itself:

https://github.com/docker/libnetwork/blob/master/drivers/bridge/bridge.go#L715

Is it possible to disable this behaviour somehow? After the daemon starts, I can remove the IP address and I am still able to use my containers.

Thanks

• daemon.json

{
    "storage-driver": "devicemapper",
    "storage-opts": [
        "dm.thinpooldev=/dev/mapper/vg--main-sys--docker--thinpool",
        "dm.use_deferred_removal=true"
    ],
    "bridge": "br-vms",
    "fixed-cidr": "172.16.0.0/16",
    "default-gateway": "172.16.0.1",
    "dns": ["172.16.0.1"],
    "iptables": false,
    "ip-forward": false
    }

• docker version

Client:
 Version:      17.07.0-ce-rc1
 API version:  1.31
 Go version:   go1.8.3
 Git commit:   8c4be39
 Built:        Wed Jul 26 20:55:16 2017
 OS/Arch:      linux/amd64

Server:
 Version:      17.07.0-ce-rc1
 API version:  1.31 (minimum version 1.12)
 Go version:   go1.8.3
 Git commit:   8c4be39
 Built:        Wed Jul 26 20:56:37 2017
 OS/Arch:      linux/amd64
 Experimental: false

Start with drivers/bridge/bridge.go at the linked line and compare that behavior with the daemon.json settings, especially bridge, fixed-cidr, iptables, and ip-forward. Determine whether the externally managed bridge can remain without an assigned address, and verify the expected container networking behavior after startup.