Blacklist network ranges Docker is allowed to use for its containers (swarm mode)
Docker should avoid using a network if there's a route to that network (see ip r). You can whitelist networks that docker is allowed to use with configurations in several places:


You can adjust bip in /etc/docker/daemon.json which controls the docker bridge network named bridge. This needs to be set to a gateway ip with CIDR notation.
You can adjust default-address-pools in /etc/docker/daemon.json which is a list of CIDR blocks for all other bridge networks.
You can pass --default-addr-pool when initializing a swarm to a CIDR block for overlay networks.


Make sure the two pools are large enough to create multiple networks, e.g. a /16 subnet to allow creation of 256 /24 networks.

More details of this are available in my DockerCon presentation (press P for presenter notes).