Accessing a Localhost Service from Inside a Docker Container

Question

I have a service bound to a localhost which I would like to be able to access from inside a Docker container. Relevant netstat output: (The service is on port 1143)

$ netstat -tulpn
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program nam
tcp        0      0 127.0.0.1:1143          0.0.0.0:*               LISTEN      23317/protonmail-br
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1527/sshd

Since Docker for linux currently has no clean way to obtain the IP of the host, I am using the qoomon/docker-host workaround image which exposes the host over a bridge network. I can access the host from my container using dockerhost:

bash-5.0# ping dockerhost
PING dockerhost (172.22.0.2): 56 data bytes
64 bytes from 172.22.0.2: seq=0 ttl=64 time=0.187 ms
64 bytes from 172.22.0.2: seq=1 ttl=64 time=0.298 ms
64 bytes from 172.22.0.2: seq=2 ttl=64 time=0.126 ms

I am using telnet to see if the container can connect to the port.

Services bound to 0.0.0.0 are accessible:

bash-5.0# telnet dockerhost 22
SSH-2.0-OpenSSH_7.6p1 Ubuntu-4ubuntu0.3

However, the service bound only to localhost is not:

bash-5.0# telnet dockerhost 1025
telnet: can't connect to remote host (172.22.0.2): Connection refused

How can I access this service from within the container, without exposing the service to the outside world?

Answer 1

Since Docker for linux currently has no clean way to obtain the IP of the host...

The clean way to get an IP address for your host is to use the address of the default gateway visible inside your container. This is the address of the bridge interface on the host to which your container is connected. Any service on your host listening on all interfaces will be accessible at this address.

However, the service bound only to localhost is not...

That's entirely expected: a service listening on the localhost address can be accessed only from the local host. It cannot be accessed from another host on a locally attached network (which is effectively what your container is from a networking perspective).

If you want to be able to access a host service from your container, you will need to either:

• Have the service listen on all addresses (0.0.0.0),
• Have the service listen explicitly on the appropriate docker bridge address, or
• Have the service listen on some other address and pass that address into the container as an environment variable or via some other configuration mechanism

Answer 2

I solved this problem in the end using IP tables.

I added my solution here, on stackoverflow:

https://stackoverflow.com/a/57833573/10735374