0

I am trying to access a service at a specific port on the host from inside a docker container. But all I am getting is Connection refused. For debugging purposes, I create a dummy listening port via nc:

host$ nc -l 888
...

And in the container I do

container$ ping 172.16.238.1
PING 172.16.238.1 (172.16.238.1) 56(84) bytes of data.
64 bytes from 172.16.238.1: icmp_seq=1 ttl=64 time=0.071 ms

container$ nc -zv 172.16.238.1 888
172.16.238.1: inverse host lookup failed: Unknown host 
(UNKNOWN) [172.16.238.1] 888 (?) : Connection refused

I am not irritated by the failing inverse host lookup, as explained at https://stackoverflow.com/questions/48779583/nc-command-inverse-host-lookup-failed-unknown-host .

Some similar questions pointed out that the binding address must match, but that seems to be fine:

host$ lsof -i -P -n | grep LISTEN
nc        13405 richardkiefer    3u  IPv4 0x69a18bda503dc55d      0t0  TCP *:888 (LISTEN)

I know that you can assign containers the host's network, which seems to fix this in other similar questions, but for security reasons I like to avoid that.

My motivation are testing and development purposes, where I would like to reach an ssh tunneld port on my host machine (ultimately reaching a remote host), so I am aware that I can link containers running different services as adviced in connecting from docker container to docker host and it does not solve my use case.

The host is macos and the firewall according to system settings is turned off.

Any suggestions? Many thanks in advance!

4
  • Can you run the same nc command successfully outside of a container, or with --net host configured in docker? Does it make a difference if you use 127.0.0.1 on your host instead of the host IP when connecting from outside of the container? – BMitch Jul 15 '19 at 14:54
  • @BMitch the nc -zv localhost 888works fine outside of the container. --net host does not make a difference: still not reachable from inside the container when giving localhost or 127.0.0.1 as the host to nc -zv, which is strange. Regarding your last question, if you mean 172.16.238.1 by the host IP, I do not use it outside of the container as it is a docker defined IP for contacting the host from inside a container, if I get it right. Thanks for your pointers. – Richard Kiefer Jul 16 '19 at 8:23
  • In addition, also nc via 172.16.238.1 does not work with --net host from inside the container. – Richard Kiefer Jul 16 '19 at 8:29
  • did you test without 127.0.0.1 on the host? – BMitch Jul 16 '19 at 9:14
1

Do not know if you have tried to contact the host from within the container via host address host.docker.internal which is a special DNS name on Mac and Windows for dev/test only. I have not tried it myself but was looking for similar for Linux.

https://docs.docker.com/docker-for-mac/networking/

Cheers!

2
  • Thanks for your response, but I already tried that. I contact the host directly via its IP 172.16.238.1, which is defined in docker's default network 'bridge'. Since the ping works, not reaching the host should not be the underlying cause. – Richard Kiefer Jul 15 '19 at 8:23
  • The container network you are trying this on, is that a network you defined or the default docker0 network? Do you get the same behavior on both of these networks when you are trying to reach port 888? – haxorof Jul 17 '19 at 6:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.