Description

After configuring mtu: 1400 in /etc/docker/daemon.json, the docker0 bridge correctly shows MTU=1400 on Docker startup with no containers. However, after running and then removing a container, docker0 MTU reverts to 1500.

This contradicts the expected behavior introduced in PR #46849 ("Explicitly set MTU on bridge devices").

Question

Should users rely on ip link, docker network inspect bridge, or another method to verify the effective MTU for containers?
Currently, docker network inspect bridge correctly shows:

"com.docker.network.driver.mtu": "1400"

Reproduce

1. Install Docker
2. Create /etc/docker/daemon.json:

 { "mtu": 1400 }

3. Restart Docker: sudo systemctl restart docker
4. Check MTU: ip link show docker0 → shows mtu 1400
5. Run and remove a container:

docker run --rm --entrypoint ls busybox /

6. Check MTU again: ip link show docker0 → now shows mtu 1500

Expected Behavior

docker0 MTU should remain 1400 at all times, as per PR #46849.
Actual Behavior
MTU reverts to 1500 after container creation/deletion cycle.

docker version

Client:
Version: 29.1.3
API version: 1.52
Go version: go1.25.5
Git commit: f52814d
Built: Fri Dec 12 14:48:47 2025
OS/Arch: linux/amd64
Context: default

Server: Docker Engine - Community
Engine:
Version: 29.1.3
API version: 1.52 (minimum version 1.44)
Go version: go1.25.5
Git commit: fbf3ed2
Built: Fri Dec 12 14:51:14 2025
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v2.2.0
GitCommit: 1c4457e00facac03ce1d75f7b6777a7a851e5c41
runc:
Version: 1.3.4
GitCommit: v1.3.4-0-gd6d73eb
docker-init:
Version: 0.19.0
GitCommit: de40ad0

docker info

Client:
Version: 29.1.3
Context: default
Debug Mode: false

Server:
Containers: 0
Running: 0
Paused: 0
Stopped: 0
Images: 4
Server Version: 29.1.3
Storage Driver: overlay2
Backing Filesystem: xfs
Supports d_type: true
Using metacopy: false
Native Overlay Diff: true
userxattr: false
Logging Driver: local
Cgroup Driver: cgroupfs
Cgroup Version: 1
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Swarm: inactive
Runtimes: io.containerd.runc.v2 runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 1c4457e00facac03ce1d75f7b6777a7a851e5c41
runc version: v1.3.4-0-gd6d73eb
init version: de40ad0
Security Options:
seccomp
Profile: builtin
Kernel Version: 3.10.0-1160.119.1.el7.x86_64
Operating System: CentOS Linux 7 (Core)
OSType: linux
Architecture: x86_64
CPUs: 16
Total Memory: 62.76GiB
Name: localhost.localdomain
ID: 801d211c-1471-4786-adab-aef7d1d9af18
Docker Root Dir: /root/data/docker-data-root
Debug Mode: false
Experimental: false
Insecure Registries:
192.168.101.76:5000
::1/128
127.0.0.0/8
Live Restore Enabled: true
Product License: Community Engine
Firewall Backend: iptables

WARNING: Support for cgroup v1 is deprecated and planned to be removed by no later than May 2029 (#51111)

Additional Info

uname -a
Linux localhost.localdomain 3.10.0-1160.119.1.el7.x86_64 #1 SMP Tue Jun 4 14:43:51 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

CentOS Linux release 7.9.2009 (Core)
Derived from Red Hat Enterprise Linux 7.9 (Source)
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

CentOS Linux release 7.9.2009 (Core)
CentOS Linux release 7.9.2009 (Core)
cpe:/o:centos:centos:7