From inside of a Docker container, how do I connect to the localhost of the machine?
Edit:
If you are using Docker-for-mac or Docker-for-Windows 18.03+, just connect to your mysql service using the host host.docker.internal
(instead of the 127.0.0.1
in your connection string).
If you are using Docker-for-Linux 20.10.0+, you can also use the host host.docker.internal
if you started your Docker container with the --add-host host.docker.internal:host-gateway
option.
Otherwise, read below
TLDR
Use --network="host"
in your docker run
command, then 127.0.0.1
in your docker container will point to your docker host.
Note: This mode only works on Docker for Linux, per the documentation.
Note on docker container networking modes
Docker offers different networking modes when running containers. Depending on the mode you choose you would connect to your MySQL database running on the docker host differently.
docker run --network="bridge" (default)
Docker creates a bridge named docker0
by default. Both the docker host and the docker containers have an IP address on that bridge.
on the Docker host, type sudo ip addr show docker0
you will have an output looking like:
[vagrant@docker:~] $ sudo ip addr show docker0
4: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 56:84:7a:fe:97:99 brd ff:ff:ff:ff:ff:ff
inet 172.17.42.1/16 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::5484:7aff:fefe:9799/64 scope link
valid_lft forever preferred_lft forever
So here my docker host has the IP address 172.17.42.1
on the docker0
network interface.
Now start a new container and get a shell on it: docker run --rm -it ubuntu:trusty bash
and within the container type ip addr show eth0
to discover how its main network interface is set up:
root@e77f6a1b3740:/# ip addr show eth0
863: eth0: <BROADCAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 66:32:13:f0:f1:e3 brd ff:ff:ff:ff:ff:ff
inet 172.17.1.192/16 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::6432:13ff:fef0:f1e3/64 scope link
valid_lft forever preferred_lft forever
Here my container has the IP address 172.17.1.192
. Now look at the routing table:
root@e77f6a1b3740:/# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 172.17.42.1 0.0.0.0 UG 0 0 0 eth0
172.17.0.0 * 255.255.0.0 U 0 0 0 eth0
So the IP Address of the docker host 172.17.42.1
is set as the default route and is accessible from your container.
root@e77f6a1b3740:/# ping 172.17.42.1
PING 172.17.42.1 (172.17.42.1) 56(84) bytes of data.
64 bytes from 172.17.42.1: icmp_seq=1 ttl=64 time=0.070 ms
64 bytes from 172.17.42.1: icmp_seq=2 ttl=64 time=0.201 ms
64 bytes from 172.17.42.1: icmp_seq=3 ttl=64 time=0.116 ms
docker run --network="host"
Alternatively you can run a docker container with network settings set to host
. Such a container will share the network stack with the docker host and from the container point of view, localhost
(or 127.0.0.1
) will refer to the docker host.
Be aware that any port opened in your docker container would be opened on the docker host. And this without requiring the -p
or -P
docker run
option.
IP config on my docker host:
[vagrant@docker:~] $ ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 08:00:27:98:dc:aa brd ff:ff:ff:ff:ff:ff
inet 10.0.2.15/24 brd 10.0.2.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::a00:27ff:fe98:dcaa/64 scope link
valid_lft forever preferred_lft forever
and from a docker container in host mode:
[vagrant@docker:~] $ docker run --rm -it --network=host ubuntu:trusty ip addr show eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 08:00:27:98:dc:aa brd ff:ff:ff:ff:ff:ff
inet 10.0.2.15/24 brd 10.0.2.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::a00:27ff:fe98:dcaa/64 scope link
valid_lft forever preferred_lft forever
As you can see both the docker host and docker container share the exact same network interface and as such have the same IP address.
Connecting to MySQL from containers
bridge mode
To access MySQL running on the docker host from containers in bridge mode, you need to make sure the MySQL service is listening for connections on the 172.17.42.1
IP address.
To do so, make sure you have either bind-address = 172.17.42.1
or bind-address = 0.0.0.0
in your MySQL config file (my.cnf).
If you need to set an environment variable with the IP address of the gateway, you can run the following code in a container :
export DOCKER_HOST_IP=$(route -n | awk '/UG[ \t]/{print $2}')
then in your application, use the DOCKER_HOST_IP
environment variable to open the connection to MySQL.
Note: if you use bind-address = 0.0.0.0
your MySQL server will listen for connections on all network interfaces. That means your MySQL server could be reached from the Internet ; make sure to setup firewall rules accordingly.
Note 2: if you use bind-address = 172.17.42.1
your MySQL server won't listen for connections made to 127.0.0.1
. Processes running on the docker host that would want to connect to MySQL would have to use the 172.17.42.1
IP address.
host mode
To access MySQL running on the docker host from containers in host mode, you can keep bind-address = 127.0.0.1
in your MySQL configuration and all you need to do is to connect to 127.0.0.1
from your containers:
[vagrant@docker:~] $ docker run --rm -it --network=host mysql mysql -h 127.0.0.1 -uroot -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.
Your MySQL connection id is 36
Server version: 5.5.41-0ubuntu0.14.04.1 (Ubuntu)
Copyright (c) 2000, 2014, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>
note: Do use mysql -h 127.0.0.1
and not mysql -h localhost
; otherwise the MySQL client would try to connect using a unix socket.
Forward a remote Docker container's port onto localhost
Assuming you have SSH access to the target machine where the container is running, you can achieve this in two steps:
- Expose container port into your VPS port, binding to its loopback IP for security:
ports:
- 127.0.0.1:5432:5432
- Use SSH port-forwarding to access port 5432 of that container:
ssh -f -N -L 127.0.0.1:5432:127.0.0.1:5432 <VPS_IP>
The above command might seem confusing, but it's requesting SSH to listen on 127.0.0.1:5432
on your client system (first ip:port pair) and port forward its connections through an ssh tunnel to 127.0.0.1:5432
(second ip:port pair) of the remote system (demonstrated with <VPS_IP>
). See this answer for more info.
Note that this ssh connection is persistent until your network remains connected. If you want to close this connection, do a ps aux | grep ssh
to find PID of ssh-forwarding process, then use sudo kill -9 $PID
to kill it.
P.S. However, this is not different with the case you connect directly to VPS_IP:5432
if you don't have security concerns.
How to access host port from docker container
When running Docker natively on Linux, you can access host services using the IP address of the docker0
interface. From inside the container, this will be your default route.
For example, on my system:
$ ip addr show docker0
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::f4d2:49ff:fedd:28a0/64 scope link
valid_lft forever preferred_lft forever
And inside a container:
# ip route show
default via 172.17.0.1 dev eth0
172.17.0.0/16 dev eth0 src 172.17.0.4
It's fairly easy to extract this IP address using a simple shell
script:
#!/bin/sh
hostip=$(ip route show | awk '/default/ {print $3}')
echo $hostip
You may need to modify the iptables
rules on your host to permit
connections from Docker containers. Something like this will do the
trick:
# iptables -A INPUT -i docker0 -j ACCEPT
This would permit access to any ports on the host from Docker
containers. Note that:
iptables rules are ordered, and this rule may or may not do the
right thing depending on what other rules come before it.you will only be able to access host services that are either (a)
listening onINADDR_ANY
(aka 0.0.0.0) or that are explicitly
listening on thedocker0
interface.
If you are using Docker on MacOS or Windows 18.03+, you can connect to the magic hostname host.docker.internal
.
Lastly, under Linux you can run your container in the host network namespace by setting --net=host
; in this case localhost
on your host is the same as localhost
inside the container, so containerized service will act like non-containerized services and will be accessible without any additional configuration.
Docker : how to (reverse) forward port to allow access to the host's localhost:PORT?
Amonst the possibilities suggested, at least on windows, the best solution is to set DISPLAY
to host.docker.internal:0.0
.
docker
can be launched by setting this option directly:
docker -e DISPLAY=host.docker.internal:0.0 <OTHERARGUMENTS>
I verified that `` connects to the localhost by lauching a netcat
session.
On the windows host (using cygwin), I started:
nc -l 127.0.0.1 3000
And I could connect to it from the VM by using:
telnet host.docker.internal 3000
When starting the netcat
deamon using
nc -l 169.254.11.167 3000
the telnet to the localhost did not succeed from the VM, telnet 169.254.11.167 3000
was required.
Therefore, host.docker.internal
(which is 168.168.65.2 inside the VM I tested), corresponds the localhost on the Windows host (and not the local host of the WSL instance running the docker container).
Forward host port to docker container
Your docker host exposes an adapter to all the containers. Assuming you are on recent ubuntu, you can run
ip addr
This will give you a list of network adapters, one of which will look something like
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP
link/ether 22:23:6b:28:6b:e0 brd ff:ff:ff:ff:ff:ff
inet 172.17.42.1/16 scope global docker0
inet6 fe80::a402:65ff:fe86:bba6/64 scope link
valid_lft forever preferred_lft forever
You will need to tell rabbit/mongo to bind to that IP (172.17.42.1). After that, you should be able to open connections to 172.17.42.1 from within your containers.
Related Topics
Shell Function to Tail a Log File for a Specific String for a Specific Time
Postgresql on Elastic Beanstalk (Amazon Linux 2)
How to Erase Printed Characters in a Console Application(Linux)
Gdb Does Not Hit Any Breakpoints When I Run It from Inside Docker Container
What Is Terminal Escape Sequence for Ctrl + Arrow (Left, Right,...) in Term=Linux
Linux Combine Two Files by Column
Ps: Clean Way to Only Get Parent Processes
Evaluating Smi (System Management Interrupt) Latency on Linux-Centos/Intel MAChine
Installing Gnuplot 5.0 on Ubuntu
How to Send Multicast Packets via a Specfic Interface in Linux
Compiling Out-Of-Tree Kernel Module Against Any Kernel Source Tree on the Filesystem
Linux Synchronization with Fifo Waiting Queue
Telnet to Login with Username and Password to Mail Server