Flannel

Flannel is a free, open-source layer 3 network fabric for containers, designed for Kubernetes. It suits operators who need host-to-host connectivity and can manage a privileged networking component; teams needing network policy enforcement must pair it with another tool.

Overview

A small agent on each host obtains a subnet lease from a configured address space, and Flannel forwards packets between hosts. Operators can keep network configuration and subnet allocations in the Kubernetes API or directly in etcd. That makes Flannel a focused connectivity layer, not a complete answer to cluster networking controls.

Documented deployments cover Kubernetes and Docker, with Linux and Windows build instructions. The project identifies integrations with kube-network-policies, Canal, K3s, and RKE2. These integrations can extend a deployment, but introduce additional components to select and operate.

Key features

• Backend selection: VXLAN is the recommended backend, with host-gw, WireGuard, UDP, and cloud integrations also documented. This gives operators options for packet forwarding, but the choice must be made before deployment: the backend documentation says not to change it at runtime.
• Encrypted option: The WireGuard backend encapsulates and encrypts packets using the in-kernel WireGuard implementation. It is the relevant choice when encrypted traffic between hosts is needed; encryption is not described for the other backends.
• Separate network policy: Flannel does not enforce network policies natively. Its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it, so policy-conscious teams can use that path, while those seeking an integrated policy layer should consider another option.
• Datastore choice: Network configuration and subnet allocations can reside in the Kubernetes API or directly in etcd. This offers a choice in how cluster networking state is stored, rather than requiring a single datastore approach.

Pricing

Flannel costs free under its free plan. It is an open-source Kubernetes networking project under the Apache 2.0 license, with no paid tier or trial described. The free plan covers the project itself; teams still need to account for operating the privileged daemonset and any separate policy controller they deploy.

Platforms

Flannel supports Kubernetes, Docker, Linux, and Windows. The project documents Kubernetes and Docker deployments and provides Linux and Windows build instructions, making it relevant to teams using those environments rather than a managed, hosted networking service.

Who it's for

Flannel is a sound fit for Kubernetes operators who want a no-cost layer 3 fabric, value a choice of forwarding backend, and are prepared to handle network policy separately. Its documented Docker deployment also suits teams connecting container workloads beyond Kubernetes. It is a weaker fit for teams that require native policy enforcement or cannot commit to a backend before runtime.

Security practice matters: Flannel runs as a privileged daemonset with host-network access, and its security policy advises least privilege and keeping deployments updated. The project maintains security fixes for the latest release only, so teams on older releases should not expect active patching. Vulnerabilities can be reported through GitHub private vulnerability reporting, with maintainers acknowledging reports within seven days. Support channels include #k3s in Rancher Users Slack, #flannel-users in Calico Users Slack, and GitHub issues for bugs.

Pros and cons

• Pros: Free under Apache 2.0. There is no software charge for using the networking project.
• Pros: Backend choice, including WireGuard. Operators can select among documented forwarding approaches, with an in-kernel encrypted option.
• Pros: Kubernetes API or etcd storage. Teams can choose where network configuration and subnet allocations are stored.
• Cons: No native network policy enforcement. Teams need a separate controller or a different networking solution for policy controls.
• Cons: Privileged host access. The daemonset's access to the host network raises the stakes for careful privilege and update management.
• Cons: Latest-release-only security fixes. Older releases are not actively patched, making timely updates important.
• Cons: Backend is a deployment-time choice. It should not be changed at runtime, so an incorrect initial selection can complicate operations.

Alternatives

Canal is another free Apache-2.0 open-source project for readers comparing container-networking options. Choose Calico Open Source when its community-driven support and maintenance, in-memory data retention, and unlimited clusters better match the requirement. CNI Plugins is a free Apache-2.0 set of reference and example CNI network plugins, rather than Flannel's host-to-host fabric. For a Kubernetes network policy implementation installable with raw manifests or Helm, consider kube-network-policies.

Antrea is a free Apache 2.0 option for Kubernetes clusters where Open vSwitch kernel modules are available on every node. Cello CNI is free but requires Volcengine ECS, Kubernetes, and Helm 3.0. DANM is another always-free Kubernetes network-management option. VMware Workstation Pro is free for 64-bit Intel or AMD PCs running Windows or Linux hosts, with no subscription or license key required. Browse more choices in Container Networking Software.

Verdict

Choose Flannel if you need free Kubernetes-oriented host networking, want a choice of documented backends, and can manage its privileged deployment responsibly. Its central trade-off is clear: it provides connectivity, not native network policy enforcement, and older releases do not receive active security fixes. If policy controls or longer-lived release maintenance are central requirements, look elsewhere or pair Flannel with a separate policy controller.