How to access containers by internal IPs 172.x.x.x #221
Comments
|
you should be able to access the containers via localhost. Does that not work? |
What do you mean by that? You mean port mapping or what? I want to reach their IPs, in my case then I use dnsdock to have DNS discovery for containers and access them by pretty dns names (without need of port mapping) |
|
So you should be able to access containers from your container host using the container IP. You can use Does that answer your question? |
|
@kallie-b ok what should I do after I got IP? I want to ping it by IP. But it won't work from dev machine. I'm asking how to do this. |
|
Right, okay--yes, I'm happy to help. So, can you provide the results that you get when you run Also, I'm assuming your dev machine is the container host--is that correct? You're not running a VM on your dev machine as the container host, or anything like that? Could you describe the steps you are taking more specifically (including where each step is executed--in the container, on the container host, or on another, external, host)? Wherever possible, also include any error messages. |
My machine is not a container host, it is a windows 10 dev machine with installed docker for windows, it has only 10.0.75.x interface related to docker, no 172.x.x.x interface to be able to communicate with 172.x.x.x addresses directly. Host machine is linux that runs on Hyper-V, called MobyLinuxVM. As I've mentioned, this will solve the issue: If I was using linux (I never used with docker), but I asume my dev machine would be also a docker host, I could access docker internal network 172.x.x.x. directly without any specific manually added routes to route table. What I want is a comment about this issue from docker team, and if they are going to make integration between windows 10 dev machine and docker internal networks deeper. |
|
ping @friism |
|
There seem to be a problem with docker network when such route: is added Log is full of events, and growing very fast (log.txt - up to 1GB for a few hours): Here is a log with this case: Which also effects on the host, CPU usage is going up to 100% some time later Can you comment on this as well? What is causing those events in the log? |
|
@whitecolor I'm not sure I understand what you are trying to achieve. Is it a Windows container or a Linux container you are trying to connect to? |
|
@dgageot |
|
Did I still failed to explain my request in OP?
By default one can not just And now But after I installed the lastest beta (build 9123) where network was changed a lot this method using routing table doesn't work anymore. So can you elaborate on this. How one can reach (ping) 172.x... containers from windows dev machine? Why the method with routing tabled stopped to worked, and how it can be fixed? |
|
@whitecolor Thanks for workaround! I need to have access to the containers directly by IP address of container, for example by |
|
@Hronom I wonder how does it work on linux by default, which gateway routes 172. address to containers? |
|
@whitecolor On linux if I type in console So there is a network interface |
|
So probably on windows host there too such of interface with proper address should be added. But should there be interfaces for each 172.x... ? |
|
If your Windows containers are connecting to the default nat network on the container host, there should be a host vNIC named (e.g., vEthernet (nat)) with the NAT network's default gateway IP address assigned to this interface. Could you please verify this by running ipconfig /all If that's true, then both the internal NAT network prefix and the external network prefix should be "on-link" from the container host's perspective and routing should happen automatically without creating static routes. I've also created a PR (MicrosoftDocs/Virtualization-Documentation#513) to help aid in container networking diagnostics as well as a clean-up script. |
|
@dgageot can you please comment on this I believe it is quite important and basic networking issue. |
|
@Hronom |
|
@whitecolor sorry I'm don't have a chance to test this under beta version... |
|
I can confirm that I can also confirm that the method is working with 1.12.3 (8488) and 1.12.5 (9503). |
|
@pachkovsky so and without route (out of the box) it too doesn't work I believe in the latest beta? @rneugeba @dgageot |
|
@whitecolor without the route it's not working neither in 1.2.x nor in 1.3 |
|
@whitecolor could you please provide exact steps on how to reproduce on what you try to achieve, including the command line you use to start |
|
@rneugeba
|
|
For those who use toolbox, if still can't access container ip directly from host after add route, but container gateway like Full instructions reference: # add route if absent, doing this only if VM is running
# 172.x.0.0/16 is subnet of your container bridge network
# $(docker-machine ip default) retrieve ip of VM in one of host network
# command syntax varies with host OS
sudo route -n add -net 172.x.0.0/16 $(docker-machine ip default)
# login VM, the real linux running docker engine
docker-machine ssh default
sudo iptables -L
# add ACCEPT if absent, default rules may vary with releases of docker
# may lose after VM reboot
sudo iptables -I DOCKER-USER -j ACCEPTSee Docker and iptables for more. |
|
I am on Win10 and had to access a host service from within a container recently, so I tried to connecting to the container with its IP, which did not work and so I landed here. The idea of system modifications with Windows + Docker networking for that purpose made me uncomfortable. For my situation, I found a little trick to avoid this entirely, and maybe it turns out to be useful for someone else too. It goes like that:
After that, you can consume the host service locally from the container's point of view. My concrete scenario was Chrome Co-Debugging with VS Code Remote Containers. I described it with more detailed instructions over here. |
for me, the ips 172.17.0.x work with Docker on linux, but not on windows. |
|
@datdinhquoc it won't work with the latest version of docker for windows as they changed networking and now there is no DockerNAT and there is no option to make it work other than installing and older version. I rolled back to 19.x and it works again with the persistent route workaround |
yes, i see it now, even on official docker website: can't ping linux containers from windows |
|
all u gotta do is use wls2 and docker, that solves every thing. |
Do you mean installing docker daemon in the WSL distro instead of Docker Desktop? Because for me, this doesn't work even using Docker Desktop with WSL2 as backend. |
docker container inside wsl2, ok, should work, tks |
yes, docker inside wsl2, not docker desktop (windows) |
|
Let's say that you cannot use WSL2 on Windows 10 Pro. WSL2 is only for those who are using Windows 10 Home. The new Docker for Windows has built-in support for WSL2 for those who are using Windows 10 Home. The software detect if you are using home or pro. |
How does this help? The problem still happens in Docker Desktop, no matter what backend. |
|
So if you are using WSL2 with Ubuntu and you have docker for Windows. you don't even need to install docker on WSL2, the docker for WIndows have an option as see below. |
|
honestly, I'm not sure how you guys are setting up your environment. my simple setup is just to use the localhost at 127.0.0.1 and it just does whatever it needs to do. maybe I'm not doing complicated things, as long as I get my setup environment the way I need it. then improve it. |
|
I feel there is no need to grab the external IP address or the network that comes with the HyperV or WSL2 network because it changes every time you restart. WSL2 allows you to ping the 172.0.0.1 automatically without doing route IP or whatever. WSL2 is integrated into Windows so why not use the localhost for everything. If you're a web dev u can always update the hosts automatically with some bash script macOS uses their own apple hypervisor you can't even access the dockerNAT. that's why using the localhost makes sense. I just build project that works for all different types of OS using HyperV, wsl2, macOS, and Linux because I use the localhost for everything. |
|
The point of this Issue isn't to discuss if using docker run -d --name alpine alpine sleep infinity
container_ip=$(docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' alpine)
ping $container_ip
docker rm -f alpine |
|
Maybe this works if you install the docker daemon in WSL2, without Docker Desktop, but didn't test it. |
|
u don't insall the daemon in wsl2, the docker desktop for windows enables that for u when u select wsl integration. i don't need to install docker on my wsl2 machine. the wsl integration in docker desktop does thatt for u. |
I know. And does the
|
|
is not going to work. u can just use dnsmasq to give container access. See this answer for your to use the docker internal DNS and you can just use service names directly |
Thanks for the suggestion. However, I believe this is a different matter. The fact is that the Issue reported here still persists even using Docker Desktop with WSL2. |
|
is not gonna work as we hope in Windows and the fact that windows, like to change major updates every twice a year, seems stupid. . I have seen it work before that you have to do more setup than you realized. using dnsmaq and resolver may help. its just an suggestion. i've done it before but i realize its just too much an hassle. well i hope you and the rest of people here can find a solution. but i think this is not gonna solve on its own. |
I don't think every setup/project/requirement is drop dead simple like a webapp running of localhost. There is a challenge where you would need to ping or connect to the container ip 172.X, which is why people are asking for help |
|
yah I understand, but then you know how windows like there UAC and security. you wouldn't have this issue if you were to use Linux because docker runs truly 100% natively so you can ping, create a network, and all that neat stuff. The majority I think Docker is made for Linux. plus, there are solutions probably that no one has found a better one I guess. |
|
@felipecassiors - You can install older version of Docker desktop for windows - I am running on ~$ docker --version You should be good after creating persistence route approach. |
|
plus, i think if you know a version that works well for u and it solves that problem, i guess stick with it.. updating to the latest version seems not logical sometimes |
|
That's right, thanks. I'm not looking for a workaround actually, I'm just reporting the issue in the newest version of Docker Desktop. |
|
Closed issues are locked after 30 days of inactivity. If you have found a problem that seems similar to this, please open a new issue. Send feedback to Docker Community Slack channels #docker-for-mac or #docker-for-windows. |
and others
How to access containers by internal IP 172.x.x.x from dev machine (with docker for windows installed)? So by default you can not connect to containers.
I found out that it can be achived by adding route manually (you actually need to add routes for each sub-netwrok, I usually do for 17-25):
Is is a valid method? Shouldn't it be made possible by default?
The text was updated successfully, but these errors were encountered: