Skip to content
SPECIFICTION
Get listed

Flannel

github.com

Free plan WindowsLinuxSelf-hosted
Visit github.com
Spec score 7.8 #10 of 28 in Container Networking Software

What it is

Flannel is a free network fabric for containers designed for Kubernetes. A small flanneld agent on each host allocates a subnet lease from a configured address space, then forwards packets between hosts using a selected backend. Documented choices include VXLAN, host-gw, WireGuard and UDP, with VXLAN recommended. WireGuard encapsulates and encrypts packets using the in-kernel WireGuard implementation. Network configuration and subnet allocations can be stored in the Kubernetes API or directly in etcd. The project documents Kubernetes and Docker deployments, with Linux and Windows build instructions. Flannel does not enforce network policies itself, though its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it. It runs as a privileged daemonset with access to the host network, so the security policy advises least privilege and keeping it updated. Security fixes are maintained for the latest release only, and the backend documentation says not to change a selected backend at runtime.

Spec sheet

Purpose
Flannel provides a layer 3 network fabric for containers designed for Kubernetes.Read 4 Oct 2026 · github.com
Integrations
The project lists kube-network-policies, Canal, K3s, and RKE2 as projects that integrate with Flannel.Read 4 Oct 2026 · github.com
Support
The project points users to the #k3s channel in Rancher Users Slack, the #flannel-users channel in Calico Users Slack, and GitHub issues for bugs.Read 4 Oct 2026 · github.com
Backends
Documented backends include VXLAN, host-gw, WireGuard, and UDP; VXLAN is the recommended choice.Read 4 Oct 2026 · github.com
Compatibility constraint
The backend documentation says a selected backend should not be changed at runtime.Read 4 Oct 2026 · github.com
Datastores
Flannel can store network configuration and subnet allocations in the Kubernetes API or directly in etcd.Read 4 Oct 2026 · github.com
Deployment security
Flannel runs as a privileged daemonset with access to the host network, and its security policy advises following least privilege and keeping it updated.Read 4 Oct 2026 · github.com
Encryption
The WireGuard backend encapsulates and encrypts packets using the in-kernel WireGuard implementation.Read 4 Oct 2026 · github.com
How it works
A small flanneld agent on each host allocates that host a subnet lease from a configured address space.Read 4 Oct 2026 · github.com
Network policy
Flannel does not natively enforce network policies, but its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it.Read 4 Oct 2026 · github.com
Notable limitation
The project maintains security fixes for the latest release only; older releases are not actively patched.Read 4 Oct 2026 · github.com
Security reporting
The security policy directs vulnerability reports to GitHub private vulnerability reporting and says maintainers acknowledge reports within seven days.Read 4 Oct 2026 · github.com
Supported environments
The project documents Kubernetes and Docker deployments, with Linux and Windows build instructions.Read 4 Oct 2026 · github.com
Traffic forwarding
Flannel forwards packets between hosts using backends including VXLAN and cloud integrations.Read 4 Oct 2026 · github.com

Plans and prices

Flannel Free Open-source Kubernetes networking project · Apache 2.0 license Read 4 Oct 2026 · github.com

Every Flannel plan and price →

Strong points and limits

Strong points

  • Free, open-source project under Apache 2.0
  • Supports Kubernetes and Docker deployments
  • Offers VXLAN, host-gw, WireGuard and UDP backends
  • WireGuard backend encrypts packets
  • Configuration can be stored in Kubernetes API or etcd

Limits

  • Does not enforce network policies natively
  • Only the latest release receives security fixes
  • Runs as a privileged daemonset with host-network access
  • Backend selection should not change at runtime

Who it suits

Flannel suits teams connecting containers in Kubernetes or Docker environments that need a host-to-host network fabric. Operators should account for its privileged daemonset and backend selection constraint.

Verdict

Flannel specifies its backends, data stores and deployment environments, with VXLAN as the recommended choice. It lacks native network policy enforcement and requires attention to privilege and release updates.

Where Specifiction places it

Alternatives to FlannelAll alternatives →