A

17

748

I have a docker container running jenkins. As part of the build process, I need to access a web server that is run locally on the host machine. Is there a way the host web server (which can be configured to run on a port) can be exposed to the jenkins container?

I'm running docker natively on a Linux machine.

UPDATE:

In addition to @larsks answer below, to get the IP address of the Host IP from the host machine, I do the following:

ip addr show docker0 | grep -Po 'inet \K[\d.]+'

Acroter answered 9/7, 2015 at 18:1 Comment(8)

Using a comment since this is a terrible answer, but I believe you can generally access it on 172.17.1.78 -- unless this is a boot2docker setup. – Candicandia 9/7, 2015 at 18:16

@Candicandia I tried that, and got this error still curl: (7) Failed to connect to 172.17.1.78 port 7000: No route to host – Acroter 9/7, 2015 at 18:41

You didn't specify; are you running boot2docker, or are you running Docker natively on Linux? – Westleigh 9/7, 2015 at 20:34

@Westleigh sorry, I just updated the question - I am running it natively on Linux. – Acroter 9/7, 2015 at 20:49

Now for Docker Desktop in Win 10(with Linux container) host.docker.internal also works, I just have to prepend http:// before it for my Java config files for the URL. Hope it helps someone. – Ir 10/8, 2020 at 11:24

Likely inside the container you don't have ip. If it's an ubuntu-based container you can do apt-get install iproute2. – Anthropogenesis 9/1, 2021 at 17:29

I think if a question has 17 answers and 650 upvotes, it probably shouldn't have been closed. – Tress 1/2, 2023 at 11:51

I found a clean solution using socat and explained it in this blog post. – Emlin 6/3 at 11:56

W

394

When running Docker natively on Linux, you can access host services using the IP address of the docker0 interface. From inside the container, this will be your default route.

For example, on my system:

$ ip addr show docker0
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default 
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever
    inet6 fe80::f4d2:49ff:fedd:28a0/64 scope link 
       valid_lft forever preferred_lft forever

And inside a container:

# ip route show
default via 172.17.0.1 dev eth0 
172.17.0.0/16 dev eth0  src 172.17.0.4

It's fairly easy to extract this IP address using a simple shell script:

#!/bin/sh

hostip=$(ip route show | awk '/default/ {print $3}')
echo $hostip

You may need to modify the iptables rules on your host to permit connections from Docker containers. Something like this will do the trick:

# iptables -A INPUT -i docker0 -j ACCEPT

This would permit access to any ports on the host from Docker containers. Note that:

iptables rules are ordered, and this rule may or may not do the right thing depending on what other rules come before it.
you will only be able to access host services that are either (a) listening on INADDR_ANY (aka 0.0.0.0) or that are explicitly listening on the docker0 interface.

If you are using Docker on MacOS or Windows 18.03+, you can connect to the magic hostname host.docker.internal.

Lastly, under Linux you can run your container in the host network namespace by setting --net=host; in this case localhost on your host is the same as localhost inside the container, so containerized service will act like non-containerized services and will be accessible without any additional configuration.

Westleigh answered 9/7, 2015 at 20:54 Comment(13)

Relevant link: adding entries to container's /etc/hosts – Triumvirate 22/3, 2016 at 10:25

How about Docker for MAC? AFAIK there is no docker0 network avilable for "Docker for MAC ". In that case how can I connect to host from container? – Alroi 27/7, 2016 at 19:41

This works - but if you're trying to connect to a service like redis, you need to add the ip address in the ip addr show docker0 command to the bind in redis.conf and restart redis. – Zanazander 1/4, 2018 at 19:35

I have used hostname of my host instead of getting IP address (hostname command on host) – Phocis 9/4, 2019 at 12:30

One scenario I found where this does not work as expected: Running Jenkins in a Docker container with /var/run/docker.sock mounted to create another container from a Jenkins job (which is a fairly common setup). The docker0 network adapter does not exist within the Jenkins container. – Savona 22/8, 2019 at 15:2

if iptables -A INPUT -i docker0 -j ACCEPT didn't do the trick for you, that may mean there's another iptable rule that prevents access. As a workaround you may insert your new rule as the first one: "iptables -I INPUT -i docker0 -j ACCEPT" (not append -A changed for insert -I in the command). Got the hint from here opensource.com/article/18/10/iptables-tips-and-tricks – Artema 2/9, 2019 at 22:38

Relevant firewall-cmd commands for CentOS: firewall-cmd --zone=internal --change-interface=docker_gwbridge && firewall-cmd --zone=internal --add-port=$MYPORT/tcp – Sweven 12/7, 2020 at 16:11

I found that both IP addresses, i.e. the address of docker0 on the host as well as the default gateway address in the container, can be used inside the container to reach the host. (In this answer they are the same, but on my setup they're not.) Is that expected? If so, it might be useful to edit to clarify that. – Mathieu 6/12, 2020 at 5:48

Any ip address of the host can be used to contact services on the host. The idea behind using the address of the docker bridge is that it's the only address that is visible (as the default gateway) inside the container. – Westleigh 6/12, 2020 at 14:36

Likely inside the container you don't have ip. If it's an ubuntu-based container you can do apt-get install iproute2. – Anthropogenesis 9/1, 2021 at 17:34

host.docker.internal worked for me on Mac – Joinder 12/4, 2021 at 13:4

After installing commands "ip" "dig" "ping" etc into the container (service) for testing, I have found... Ping is always sucessful, but attempted to access the published ports of another service results in "No Route to Host". However turning off iptables, and this changes to "Could not resolve host" and using the IP directly for the connection works! So I reenabled the iptables and added the appropriate ACCEPT rules, but sill not having much luck. Work continues. – Duodenum 28/4, 2021 at 23:27

@merito the new value to use is docker.for.mac.host.internal, would you mind updating your comment since it has so many upvotes – Stoush 17/12, 2022 at 22:17

W

955

For all platforms

Docker v 20.10 and above (since December 14th 2020)

Use your internal IP address or connect to the special DNS name host.docker.internal which will resolve to the internal IP address used by the host.

This is for development purpose and does not work in a production environment outside of Docker Desktop.

Linux caveats

To enable this in Docker on Linux, add --add-host=host.docker.internal:host-gateway to your docker command to enable the feature.

To enable this in Docker Compose on Linux, add the following lines to the container definition:

extra_hosts:
    - "host.docker.internal:host-gateway"

According to some users the special DNS name only works within the Docker's default bridge network, not within custom networks.

For older macOS and Windows versions of Docker

Docker v 18.03 and above (since March 21st 2018)

Use your internal IP address or connect to the special DNS name host.docker.internal which will resolve to the internal IP address used by the host.

Linux support pending https://github.com/docker/for-linux/issues/264

For older macOS versions of Docker

Docker for Mac v 17.12 to v 18.02

Same as above but use docker.for.mac.host.internal instead.

Docker for Mac v 17.06 to v 17.11

Same as above but use docker.for.mac.localhost instead.

Docker for Mac 17.05 and below

To access host machine from the docker container you must attach an IP alias to your network interface. You can bind whichever IP you want, just make sure you're not using it to anything else.

sudo ifconfig lo0 alias 123.123.123.123/24

Then make sure that you server is listening to the IP mentioned above or 0.0.0.0. If it's listening on localhost 127.0.0.1 it will not accept the connection.

Then just point your docker container to this IP and you can access the host machine!

To test you can run something like curl -X GET 123.123.123.123:3000 inside the container.

The alias will reset on every reboot so create a start-up script if necessary.

Solution and more documentation here: https://docs.docker.com/desktop/networking/#use-cases-and-workarounds-for-all-platforms

Waggish answered 21/4, 2017 at 11:36 Comment(15)

I've successfully tested this. No need to turn off the firewall – Pedropedrotti 22/5, 2017 at 13:49

docker.for.mac.localhost works nicely - except when using Chrome for browser testing (it disallows *.localhost referring to the host machine rather than the immediate container, as per: github.com/docker/for-mac/issues/1837). I found 192.168.65.1 worked instead. – Thorn 25/9, 2017 at 14:57

changed to host.docker.internal docs.docker.com/docker-for-mac/networking/… – Butchery 27/3, 2018 at 12:17

Is host.docker.internal supposed to work also on Ubuntu? After having run docker run -it ubuntu:trusty bash the command root@40a5887b060d:/# ping host.docker.internal gives me ping: unknown host host.docker.internal – Crimmer 14/4, 2018 at 16:8

@SimonForsberg It's supposed to, but apparently it only works on Windows and macOS at the moment. There's an open ticket here github.com/docker/for-linux/issues/264 – Waggish 15/4, 2018 at 19:39

Recommend use host.docker.internal in the docker container and config 127.0.0.1 host.docker.internal in hosts file. – Compound 19/6, 2018 at 11:14

I would second @junlin's comment here to add an entry to your host system's /etc/hosts file – 127.0.0.1 host.docker.internal – after I added this missing entry (and on macOS at least restarted mDNSResponder with sudo killall -HUP mDNSResponder to reload the changed hosts file), I was able to successfully connect to services running on my host machine from within Docker, where other approaches had not worked! – Aspinwall 27/6, 2019 at 5:24

host.docker.internal work perfect for me! in my case the WSL change the IP on every reboot :/ – Midshipman 24/6, 2021 at 15:57

I also needed to open up the port that I wanted to access on the host using the ubuntu firewall. Trying to figure out how to minimally open up this port since I don't want the whole world to have access to it... – Foetation 9/3, 2022 at 21:29

This is the only way that worked for me on WSL with Docker for Windows. – Magnifico 8/9, 2022 at 12:19

Love you... saved my @ss. – Slander 9/2, 2023 at 20:54

"does not work in a production environment outside of Docker Desktop." Surely this is incorrect? It does actually work without Docker Desktop. – Oidea 5/4, 2023 at 16:53

Is this host.docker.internal solution for production or not? If not , what should be used instead? – Kirovograd 9/10, 2023 at 4:8

@Kirovograd you would never connect to the host. You would instead do whatever you need the host to accomplish on another container and connect to that. – Waggish 18/10, 2023 at 13:45

@janneAnnala Your solution worked like a charm—thanks! For those leveraging the UFW firewall with custom networks instead of the default bridge, don't forget to include the necessary allow rules. This ensures that the Docker container subnet can communicate with the host on your specified port. – Guadiana 24/10, 2023 at 9:57

W

394