0

Consider I have docker-subdomain.mydomain.com pointing to a website in a Docker container, and host-subdomain.mydomain.com pointing to a website in the Host itself. Both these websites are in the same Host and IP address.

When the PHP code of the docker-subdomain.mydomain.com inside Docker makes a curl call to host-subdomain.mydomain.com, and that host-subdomain.mydomain.com logs the IP address of the caller, it appears to be an IP address starting with "172.", which means it's the private IP address of the docker container.

I'm wondering how is the private IP address used, if the DNS of host-subdomain.mydomain.com is the public IP, so I'd think it would use the external interface to connect? (like it happens when a PHP script executes curl in the host itself, outside Docker)

How does Docker know that host-subdomain.mydomain.com points to the same host?

--

Note: I'm not asking how to bypass/change this behavior - I'm just curious, as it's doing exactly what I wanted it to do, but I don't understand why.

1 Answer 1

0

I'm wondering how is the private IP address used, if the DNS of host-subdomain.mydomain.com is the public IP, so I'd think it would use the external interface to connect?

You're looking at the ip address of the client, not the ip address to which curl is connecting. The process looks something like:

  1. Your PHP code calls something like curl host-subdomain.mydomain.com

  2. curl looks up the name host-subdomain.mydomain.com

  3. curl find the address (e.g.) 100.64.0.100

  4. curl opens a connection to 100.64.0.100

  5. The kernel looks for a route to that address

  6. Inside the container, the routing table looks something like:

    default via 172.17.0.1 dev eth0
    172.17.0.0/16 dev eth0 scope link  src 172.17.0.2
    
  7. Because the container doesn't have a direct route to 100.64.0.100, it uses the default route, which corresponds to the docker bridge on your host.

  8. Your application on the host sees a connection originating from the docker bridge with the ip address of the container.

In all of these steps, the connection is from the container ip address to the resolved address of host-subdomain.mydomain.com.


You have this:

enter image description here

Your container (172.20.0.2) has route to the host address ("100.64.0.100" in this example) via its default route (172.20.0.1). Your host has a route to the container (via the br-1234 interface).

8
  • Thank you. However, regarding your step 2 and 3 -- why would the lookup return a private IP, if the DNS has a public IP? (the IP of the host)
    – Nuno
    May 14, 2023 at 0:22
  • I think you have misunderstood the answer -- the lookup does not return a private ip. It returns whatever ip results from a DNS lookup of host-subdomain.mydomain.com. I picked 192.168.1.200 as an example; when reading the answer replace that with whatever address is appropriate. You didn't indicate that address in your question so I had to pick something.
    – larsks
    May 14, 2023 at 0:24
  • Thanks for clarifying. No problem (in my original question, I said it was a public IP :-)). I believe I understand what you're trying to say. However, I'd have thought that once it's a public IP, it would use the external network interface (e.g. eth1, based on the route table), even if it's bridged through the host. So the caller's IP address would be the Host's public IP.
    – Nuno
    May 14, 2023 at 0:27
  • Your container has a private ip address. It's connecting to an address on the host. There is no step in this process that will transform the container ip address into some other address. Your host is directly connected to the container network.
    – larsks
    May 14, 2023 at 0:28
  • "It's connecting to an address on the host." - I understand, but neither the Container or the Host knows that. "ping host-subdomain.mydomain.com" returns the public IP. So unless there's something in the Docker-Host interaction that checks "is the IP address the same as the Host's? then use internal network", it doesn't make sense to me. If the Container connects to another Host, that Host's code wouldn't see the private IP.
    – Nuno
    May 14, 2023 at 0:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .