network_mode: "host" probably not working as expected

[ealves-pt]

I'm trying to run from a docker-compose.yml the a service with network_mode: "host" but it doesn't seem to be working as expected in OS X.

Having the docker-compose.yml:

version: '2'
services:
  db:
    image: postgres:9.6.1-alpine
    environment:
      POSTGRES_USER: arexdb_dev
      POSTGRES_PASSWORD: arexdb_dev
      PGDATA: /var/lib/postgresql/data/pgdata
    volumes:
      - ~/docker-data/postgresql:/var/lib/postgresql/data/pgdata
    expose:
      - "5432"
    ports:
      - "5432:5432"
    restart: always
    network_mode: "host"

Expected behavior

Running nmap -sT 127.0.0.1 should output:

PORT     STATE SERVICE
5432/tcp open  postgresql

Actual behavior

Running nmap -sT 127.0.0.1 doesn't show the expected port.

[djs55]

Unfortunately Docker for Desktop doesn't currently support the "host" network_mode where containers are able to freely bind host ports without being managed by docker. Instead, ports must be explicitly whitelisted in the docker run or the docker-compose.yml.

I notice that you have white-listed port 5432 in your docker-compose.yml. If you use the "bridge" network mode, e.g.:

    network_mode: "bridge"

then port 5432 should be bound on the host.

$ netstat -an | grep 5432
tcp6       0      0  ::1.5432               *.*                    LISTEN     
tcp4       0      0  *.5432                 *.*                    LISTEN  

I believe "bridge" mode is actually the default so you could delete the network_mode line from your docker-compose.yml if you wished.

In the longer term we're still considering what it would take to make network_mode: host work. If you have particular use-cases in mind, please let us know.

[arup42]

There are plenty more issues related to net=host not working the way it does on linux, like #155 (which has the most useful information on it) and maybe #68 and #57

If this is going to be where this issue is consolidated, please also take note of this thread that sounded like it might contain a workable solution but hasn't been commented on either way by someone from docker as far as I know.

As far as use cases, I use docker to run an application that (1) scans the local network looking for other devices and needs to see their mac addresses, and (2) dynamically binds to a local port that will later be used by other hosts to contact it. Both of these things work fine on linux with --net=host, and don't work as expected on a mac.

Apologies in advance if I'm conflating things that you guys see as distinct issues, but it would definitely help if someone from docker could provide some guidance on whether it's realistic to hope that --net=host will ever work the same way it does on linux. Thanks.

[ingshtrom]

I'll add our current use case that is failing right now:

We have nginx acting as a reverse proxy for our other services. Each service and nginx are all in separate containers. We run our services in Swarm mode with 1.13 (using docker compose v3), and then using another compose file, run nginx, which is supposed to communicate with each service. We could add nginx to the swarm or use container linking, but then we have to change our nginx config in production vs local dev because we run nginx directly on hosts in production. I did get that working with a sed command at startup and passing in the host IP as an environment variable, but then there is the problem of the Mac changing IPs, so every time Mac decides to change IPs, the developer needs to re-setup the whole environment...

The idea was that we could run nginx in network_mode: 'host' and then always reference 127.0.0.1:<service_port>, which is exactly the same way we do it in production. Unfortunately, when I set that up, I only get empty responses from hitting port 80 or 443 locally when nginx is started up (aka what the OP said).

I am open to workarounds or other ideas, but host mode would make this a lot easier :)

[manfredriem]

It appears it is possible for a standard xhyve install is able to allow access to the xhyve VM from the outside as indicated by the blog post at http://mifo.sk/post/xhyve-for-development

I think this would be the first step to properly supporting --net=host in Docker for Mac

Can someone from the Docker team investigate this?