I'm posting this as a "discussion," even though my issue has been resolved, to possibly help the next customer who is surprised by this and (maybe?) to get someone at Cisco to notice this.
The UCCX 12.5(1) install/upgrade happens to install the Docker Engine - which rates precisely three words in the 698-page UCCX Administration and Operations Guide. That install also builds a Docker "bridge network" without any input from the customer/installer, and according to Docker docs, "It randomly chooses an address and subnet from the private range defined by RFC 1918 that are not in use on the host machine, and assigns it to docker0. By default it chooses a 16-bit netmask..." Based on what I've seen, "random" is a lie. If your UCCX happens to be in 172.17.0.0, this install will take 172.18.0.0/16 for itself. If you have the misfortune of using 172.18.0.0 for your user networks, well, it sucks to be you, as all those networks will be unreachable. Again, to emphasize, the install does not notify you it's doing this, let alone offer an option to disable this or to modify the address range, and you end up with this
admin:show network route
default via 172.17.0.nnn dev eth0 proto static metric 100
172.17.0.0/24 dev eth0 proto kernel scope link src 172.17.0.nnn metric 100
172.18.0.0/16 dev docker0 proto kernel scope link src 172.18.0.1
Really nice surprise to find when you go live and can't figure out what's happening to your traffic, then eventually find this and realize that you can't delete the route. There is apparently a COP file that's supposed to resolve this, but the install fails more than it succeeds, so time for TAC to get root access and fix this for you. If you find yourself in this situation, open a P1 case, reject the COP file advice and insist on the "root" workaround. Do not release the call until this is done.
As to the question of who at Cisco, a company that has been at the forefront of networking standards and best practices for over three decades, would allow a system install to blithely commandeer user networks without any notice nor any opportunity to reject or modify this behavior, I am truly at a loss. Hey, let's just grab a /16 that's not in use on this particular box as if this box doesn't have connectivity beyond its own subnet. I'm at a loss for words.
