Docker for windows is not mapping ports to localhost

[panmanphil]

Expected behavior

Using a simple example of the FROM microsoft/iis and EXPOSE 8000 as shown in the samples, this type of command runs, and I can access the port on the ip address shown from docker inspect. However when I use port mapping like so:

docker run -d -p 8080:8000 --rm iissite

I expect to be able to access the site from http:/localhost:8080, instead only the nat ip and EXPOSE port are reachable.

Actual behavior

unable to connect

Information

• Diagnostic ID from "Diagnose & Feedback" in the menu.
• a reproducible case if this is a bug, Dockerfiles FTW
• page URL if this is a docs issue or the name of a man page
• host distribution and version (Windows version, build number, etc)
  Client:
  Version: 1.12.0
  API version: 1.24
  Go version: go1.6.3
  Git commit: 8eab29e
  Built: Thu Jul 28 23:54:00 2016
  OS/Arch: linux/amd64

Server:
Version: 1.12.2-cs2-ws-beta
API version: 1.25
Go version: go1.7.1
Git commit: 050b611
Built: Tue Oct 11 02:35:40 2016
OS/Arch: windows/amd64

windows version 1607 build 14393.351

Dockerfile
FROM microsoft/iis
RUN mkdir C:\site
RUN powershell -NoProfile -Command
Import-module IISAdministration;
New-IISSite -Name "Site" -PhysicalPath C:\site -BindingInformation "*:8001:"
EXPOSE 8001
ADD . /site

Steps to reproduce the behavior

docker run -d --name site iissite
(from powershell)
docker inspect --format='{{.NetworkSettings.Networks.nat.IPAddress}}' site
wget "http://:8001" -UseBasicParsing
You see StatusCode 200

docker stop site
docker rm site
docker run -d -p 8080:8001 --name site iissite
wget "http://localhost:8080" -UseBasicParsing

get "unable to connect to the remote server"
also try trying the ip of ethernet0 from ip config

with linux containers and previous version of docker for windows, this works and works well

[panmanphil]

Running the same type of -p option on Windows 2016 also does not work. On the Windows 2016 I tried all of the available ip addresses but only the address shown from docker inspect and the original port from the EXPOSE statement worked. I could swear this worked before, and have been doing this for all of this year with the linux/mac versions of docker.

[rn]

@panmanphil thanks for the report. Probably confusing, but networking for Windows containers is done differently to the way we run Linux containers on Windows (and the Mac). For Linux containers we use a component, called VPNKit, which watches containers with exposed ports being created and exposes them on the localhost. For Windows containers this component is not used and containers and their ports are only accessible via the NATed IP address.

This is expected behaviour and I'm closing this issue. We should probably add this to our documentation (/cc @londoncalling).

[panmanphil]

This isn't just the loopback connector that isn't working. I tried all the ip addresses on the box listed from ipconfig, and none of them could be used to connect. Only the nated container ip address and port worked. What is the purpose of having -p then if not to put the port on one of the host's ip addresses?

Yes please do update the documentation, I can't be the first to spend a bunch of time on this.

[friism]

@panmanphil the containers are currently only available on the container IP:

 docker inspect --format '{{ .NetworkSettings.Networks.nat.IPAddress }}' <container>  

Details here: https://blog.sixeyed.com/published-ports-on-windows-containers-dont-do-loopback/

[Rusk85]

Is this still an issue. Because I tried it with the lastest version of Docker on Win10Pro and netstat -ap | grep PORT gave me nothing.

[jonstelly]

This is still an issue but if/when it will be resolved seems murky. For anyone else that might be frustrated, I've put together an admittedly sub-optimal work-around for this limitation, DockerProxy. It's a dotnet core console app that proxies from localhost:{port} -> docker-container:{port}. It monitors docker and will start/stop listening on ports as containers come up or down.

[szydan]

For me NATing the port in VirtualBox worked
Go to VirtualBox -> Your BOX -> Settings -> Network ->
Choose NAT
Open Advanced
Click Port Forwarding
Add new rule to map whatever port you need from host to guest
Click OK, OK
Then stop, start the BOX

[vguna]

@jonstelly : thanks for the docker proxy. But it doesn't seem to work for me. I just start it on my Windows 7 Home like this:

D:\Coding\DockerProxy>dockerproxy
Hosting environment: Production
Content root path: D:\Coding\DockerProxy
Now listening on: http://localhost:5000
Application started. Press Ctrl+C to shut down.

Starting stopping docker image via docker on cmd line doesn't have any effect. I'm missing something here? I also don't understand why it is listening on 5000. Can it be remote controlled or something?

[vguna]

Ok, I digged deeper into the rabbit hole and debugged/compiled my own version to see what's the problem here. Forget about the listening stuff I wrote :).

First of all, I have to run the docker tools (docker-machine) on my Windows 7. I think this is the main reason, that DockerProxy is not working out of the box. I did two things to make it work:

In Proxy.cs there something like var nat = Container.NetworkSettings.Networks["nat"];. This silently fails, because in my json there's only a "bridge". After changing that, it starts to bind to 172.17.0.2 - which doesn't work because with the docker-machine, the IP of the VM has to be used - 192.168.99.100 in my case. So for testing I just hardcoded the ip to it, and now it seems to work.

I think it should be possible to get that IP via docker-machine ip. Are there any plans to add docker-tools support to docker proxy?