Flannel
What it is
Flannel is a free, open-source network fabric for containers designed for Kubernetes. A small flanneld agent on each host receives a subnet lease from a configured address space, and Flannel forwards packets between hosts through a selected backend. Documented choices include VXLAN, host-gw, WireGuard, and UDP; VXLAN is recommended, and the backend documentation says not to change the selection at runtime. The WireGuard backend encapsulates and encrypts packets using the in-kernel WireGuard implementation. Network configuration and subnet allocations can be kept in the Kubernetes API or directly in etcd. Flannel documents Kubernetes and Docker deployments, with Linux and Windows build instructions. It does not enforce network policies itself, though its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it. Listed integrations include kube-network-policies, Canal, K3s, and RKE2. Flannel runs as a privileged daemonset with host-network access, so its security policy advises least privilege and keeping it updated. Only the latest release receives security fixes. It is available under the Apache 2.0 license.
For and against
For
- Free, open-source project under Apache 2.0.
- Supports Kubernetes and Docker deployments.
- Offers VXLAN, host-gw, WireGuard, and UDP backends.
- Can store allocations in Kubernetes API or etcd.
- WireGuard backend encrypts packets.
Against
- Does not enforce network policies natively.
- Backend selection should not change at runtime.
- Only the latest release receives security fixes.
- Runs privileged with access to the host network.
The verdict
Flannel provides a defined set of container networking backends and supports Kubernetes and Docker deployments. Account for its runtime backend constraint, privileged host access, and latest-release-only security fixes when considering it.
Who it suits
Flannel suits teams configuring container networking for Kubernetes or Docker deployments. It is relevant to users who need a choice of packet-forwarding backends or a WireGuard encryption option.
Plans and prices
Flannel
Open-source Kubernetes networking project · Apache 2.0 license
Read 4 Oct 2026 · github.com
On the record
- Backends
- Documented backends include VXLAN, host-gw, WireGuard, and UDP; VXLAN is the recommended choice.github.com · read 4 Oct 2026
- Compatibility constraint
- The backend documentation says a selected backend should not be changed at runtime.github.com · read 4 Oct 2026
- Datastores
- Flannel can store network configuration and subnet allocations in the Kubernetes API or directly in etcd.github.com · read 4 Oct 2026
- Deployment security
- Flannel runs as a privileged daemonset with access to the host network, and its security policy advises following least privilege and keeping it updated.github.com · read 4 Oct 2026
- Encryption
- The WireGuard backend encapsulates and encrypts packets using the in-kernel WireGuard implementation.github.com · read 4 Oct 2026
- How it works
- A small flanneld agent on each host allocates that host a subnet lease from a configured address space.github.com · read 4 Oct 2026
- Integrations
- The project lists kube-network-policies, Canal, K3s, and RKE2 as projects that integrate with Flannel.github.com · read 4 Oct 2026
- Network policy
- Flannel does not natively enforce network policies, but its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it.github.com · read 4 Oct 2026
- Notable limitation
- The project maintains security fixes for the latest release only; older releases are not actively patched.github.com · read 4 Oct 2026
- Purpose
- Flannel provides a layer 3 network fabric for containers designed for Kubernetes.github.com · read 4 Oct 2026
- Security reporting
- The security policy directs vulnerability reports to GitHub private vulnerability reporting and says maintainers acknowledge reports within seven days.github.com · read 4 Oct 2026
- Support
- The project points users to the #k3s channel in Rancher Users Slack, the #flannel-users channel in Calico Users Slack, and GitHub issues for bugs.github.com · read 4 Oct 2026
- Supported environments
- The project documents Kubernetes and Docker deployments, with Linux and Windows build instructions.github.com · read 4 Oct 2026
- Traffic forwarding
- Flannel forwards packets between hosts using backends including VXLAN and cloud integrations.github.com · read 4 Oct 2026
