- What I did

Add value isolated for bridge labels com.docker.network.bridge.gateway_mode_ipv[46].

It prevents assignment of an address to the bridge, so the host has no address in the network - and can only be used when the network is also --internal.

For IPv4, mode isolated is equivalent to --internal -o com.docker.network.bridge.inhibit_ipv4=true - since commit 43f71fb, no gateway address is allocated in that case. Apart from isolated working for IPv6 too, the difference is in the intended use - inhibit_ipv4 is described as a way to put the gateway address somewhere-else (see Skip IP address configuration) so, it's fine to use it without --internal, but it doesn't necessarily isolate the network. Whereas, mode isolated can only be used with --internal and fits alongside the other gateway_mode_ipv[46] options as a way to control connectivity of containers on the network.

- How I did it

Don't assign an address to the bridge in isolated mode.

For gateway_mode_ipv6=isolated, disable IPv6 on the bridge so that it doesn't get a link-local address.

- How to verify it

New integration tests.

- Description for the changelog

- An `internal` bridge network created with gateway mode `isolated` does not have an address on the docker host.
  - An address is normally assigned to the bridge device in an `internal` network, so processes on the docker host can access the network, and containers in the network can access host services listening on that bridge address (including services listening on "any" host address, `0.0.0.0` or `::`).
  - The `network create` options are `-o com.docker.network.bridge.gateway_mode_ipv4=isolated` and `-o com.docker.network.bridge.gateway_mode_ipv6=isolated`.