I have two ethernet interfaces on my server: one for my regular use lan and one for cctv. Each interface has its own bridge, although no other interface belongs to that bridge (pointless I know). For some reason, my docker containers didn't work if I passed the interface directly to them, but they did with the bridge.

Each bridge, creates an additional interface named "shim-brX". Some even get assigned as default with the highest priority metric. I manually clean up my routing table from the shim-br interfaces and assign proper default route and priorities. Basically, the regular lan is the default and the cctv subnet gets routed through its corresponding interface.

Despite that, after every reboot, the whole routing table gets messed up again with the shim-brX interfaces, the server looses the way to get packets out to my main router and docker containers loose internet access. It's a pain in the neck to have to set it all up again after every boot. How can I make my changes stick? Or how can I prevent the shim-br interfaces being created. Even more, why can't I just pass the interface to the containers and avoid the whole bridging thing?

My routing table now with the unnecessary interfaces and no internet

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         192.168.19.1     0.0.0.0         UG    0      0        0 shim-br2

default         192.168.19.1     0.0.0.0         UG    1011   0        0 br2

default         192.168.112.1    0.0.0.0         UG    1012   0        0 br3

172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0

192.168.19.0     0.0.0.0         255.255.255.0   U     0      0        0 shim-br2

192.168.19.0     0.0.0.0         255.255.255.0   U     1011   0        0 br2

192.168.112.0    0.0.0.0         255.255.255.0   U     0      0        0 shim-br3

192.168.112.0    0.0.0.0         255.255.255.0   U     1012   0        0 br3

192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0

shim networks are created when the Docker setting "Host access to custom networks" is enabled; that is normal and should not cause any issues by itself, but if you don't need that you can disable host access and they will no longer be created.