Support Host Network (--network host) mode on Docker Desktop for Mac and Windows

Tell us about your request

Right now, docker run --network host <image> is only available to Linux docker hosts. From the official documentation:

The host networking driver only works on Linux hosts, and is not supported on Docker Desktop for Mac, Docker Desktop for Windows, or Docker EE for Windows Server.

Which service(s) is this request for?

Docker Desktop for Mac, Docker Desktop for Windows

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?

Making a docker container with dynamic port mappings is not possible right now.

For example, a container that allows a user to accept connections on arbitrary ports through a netcat listener. During a network penetration test, the user may be testing outbound firewall rules and needs to dynamically accept connections on different ports in the container, eg 53, 80, 443, 1337, 9001, or any other arbitary port. The user will not know these ports before starting the container, so it's not possible for the user to run the container with docker run -p <ports> <image>.

With docker run --network=host, this could be accomplished by just using the same network schema as localhost.

Are you currently working around the issue?

The "best" workaround I know of would to add an EXPOSE 1-1000 in the Dockerfile and run the container with docker run -P <image>, which is very slow and does still limits the range of open ports. Using the full port range of EXPOSE 1-65535 hangs my terminal, so I don't know how effective it is.

The -P flag is documented here: https://docs.docker.com/network/links/#connect-using-network-port-mapping

This is not a sustainable workaround.

Additional context

Although documentation stats not supported on any O/S but Linux, it also doesn't seem to work correctly (although it doesn't throw error) on Linux flavors on WSL2. The swarm configurations likewise don't function as they do in "bare metal" Linux, which can make for a ton of confusion in the docs.

There is a large and growing population of Mac/Windows users that are not fully supported by the extant documentation, and issues like this (many other networking issues exist on those platforms too).

I plan to follow this thread closely, and would welcome the chance to help refine docs so they apply across the board, or exceptions are noted where they exist.

What is basically needed to make this work? Where would one need to start looking to make this work on MacOS?
Any basic information on how to start that would be much appreciated.
I think technically this should be doable, also from the community. It's currently just not on the roadmap..?

Having this supported could maybe help with the horrible network performance I see on macos docker ...

This makes for instance using postgres in a container very painful.
Running our test suite using a postgres in a container and with docker 4.6:
virtualization.framework: 16min
hypervisor.framework: 10min
locally installed postgres: 3min

Hi - thanks for this issue and sorry for the delayed reply. We'll do some scoping on this and circle back on this thread shortly.

This is certainly a feature I would love to see support for. lacking host network support makes it impossible for me to run services that need to be network aware on anything other than linux, since otherwise they only see the network bridge.

Another limitation I've found - not being able to run a local Redis cluster https://redis.io/docs/manual/scaling/#redis-cluster-and-docker

Related to docker/desktop-linux#87

Now with the new release 4.14.0 of Docker Desktop on Mac utilizing the Apple Virtualization Framework, it should be possible to add another network adapter featuring the bridged network aka. network_mode = host ?

https://developer.apple.com/documentation/virtualization/vzvirtualmachineconfiguration/3656724-networkdevices

Is this a big challenge? Can somebody point out the hypervisor configuration for the Apple Virtualization Framework here? :)

Also thanks for putting it in the "Considering" space of the docker-roadmap ! 👍

+1 - would be really nice to get this implemented as it works on Linux!

Now with the new release 4.14.0 of Docker Desktop on Mac utilizing the Apple Virtualization Framework, it should be possible to add another network adapter featuring the bridged network aka. network_mode = host ?

developer.apple.com/documentation/virtualization/vzvirtualmachineconfiguration/3656724-networkdevices

Is this a big challenge? Can somebody point out the hypervisor configuration for the Apple Virtualization Framework here? :)

Also thanks for putting it in the "Considering" space of the docker-roadmap ! 👍

Is there any way to get more updates on this ? I think this would be an extremely appreciated feature for mac users

Here's the link to the filter to track its progress!

https://github.com/docker/roadmap/projects/1?card_filter_query=network+host

Yes please. Very much please.

@vadimen

@vadimen I'm not super familiar with Windows Containers networking. I think it's worth looking for a similar issue or asking on https://github.com/microsoft/Windows-Containers.

@Nemesis7

@Nemesis7 What ports Scrypted is listening to? Are some of them bound by DD on the host? It's probably worth filling a new issue in either https://github.com/docker/for-win or https://github.com/docker/for-mac.

@akerouanton By default it's port 10443, plus there one port for HomeKit which is variable and there is the mDNS port i.e. 5353, but shouldn't this recent release allow any container with network_mode: host to be reachable via localhost? For Scrypted I can create a new issue, but I think reachability via localhost is related to this thread, no ?

@Nemesis7

@Nemesis7 It's definitely related but it'd be better to have a proper bug report.

Hm, am I missing something?

I'm running 4.30.0:

Under "Features in development" I enabled "Enable host networking":

(For unknown reasons that checkbox only became enabled when I logged into an account, it's unclear to me how networking and login are related.)

If I now run netcat in listen mode in a container:

I am unable to connect to that from outside the container:

But if I exec into the container and try the connection from there, it works:

That should work from the host as well, or not?

Using -l and -p together is an error. From nc(1):

     -l      Used to specify that nc should listen for an incoming connection
             rather than initiate a connection to a remote host.  It is an
             error to use this option in conjunction with the -p, -s, or -z
             options.  Additionally, any timeouts specified with the -w option
             are ignored.

     -p source_port
             Specifies the source port nc should use, subject to privilege
             restrictions and availability.  It is an error to use this option
             in conjunction with the -l option.

Also, when using listener mode the port is random:

/ # nc -lv
listening on [::]:56323 ...

If you run a listener like this, and then try to connect to it using localhost on the outer system, it still won't work, because you can see it is bound to [::] which is the IPv6 stack. The --net=host parameter will only bind to IPv4, so the last piece of the puzzle is to specify an IPv4 address to bind to...

/ # nc -lv 0.0.0.0
listening on 0.0.0.0:59271 ...

And after this, connecting to localhost on the outer host, using the port in the message (59271 in this example) should work. I tested this on Mac, although I see you're using Windows. I would hope it works the same, but YMMV.

What image are you using for your container? The netcat syntax you're using is for BSD netcat, for GNU and Busybox netcat my syntax should be ok.

I tried installing BSD netcat in my Alpine container but I couldn't get it to work with your commands:

I tried specifying a local IPv4 address to rule out the IPv6 issue you mention with nc -l -p 1234 -s 0.0.0.0 and nc -l -p 1234 -s 127.0.0.1 but the netcat is still not reachable from the host.

Based on your screenshot, to replicate your environment, I used alpine:latest.

❯ docker image ls alpine:latest
REPOSITORY   TAG       IMAGE ID       CREATED       SIZE
alpine       latest    8e1d7573f448   2 years ago   5.33MB

I will admit I probably used the manpage from macOS (which would have the BSD version), not realizing the disparity between it and GNU/Linux. But the behavior I tested and pasted output from came from alpine:latest:

❯ docker run -it --rm --net=host alpine:latest
/ # nc -lv 0.0.0.0
listening on 0.0.0.0:55201 ...

I see now that your syntax works and has the right port (which it clarifies with -v). But, it binds to IPv6 only, which leads back to my observation about needing to use IPv4:

/ # nc -l -p 1234 -v
listening on [::]:1234 ...

If you bind to the IPv4 stack it then allows connection from the outside host:

/ # nc -lk -p 1234 -v -s 0.0.0.0 -e date
listening on 0.0.0.0:1234 ...
connect to 192.168.65.3:1234 from 192.168.65.1:38201 (192.168.65.1:38201)

❯ nc localhost 1234
Sat May 18 22:32:06 UTC 2024

Using your command line doesn't work for me:

Ah, sorry to see that. Unfortunately I have no explanation for it. I would guess it is a difference in the Mac vs. Windows environment (either the network stack, or the way Docker Desktop works with the host OS, or both). I don't have any Windows machines around here to test it.

It doesn't work with me. I'm using v4.33.0 on Windows 11, and have enabled the feature after signing in. Alas, docker info doesn't show the host network mode as available, and starting a container with --net=host throws an error.

Network: ics internal l2bridge l2tunnel nat null overlay private transparent

Am I doing something wrong? Do I have to create the host network somehow?

@s13n

@s13n This feature isn't compatible with Windows containers. It's meant to be used with Linux containers, on both macOS and Windows.

@akerouanton

@akerouanton Thanks! That wasn't clear to me, and the explanatory text near the tick box in the settings dialog doesn't mention it. Maybe it would be an idea to disable the choice when Docker Desktop is in Windows container mode.

@s13n

@s13n Thanks for reporting! This should be fixed in the next release (4.34).

Navigation Menu

Repository navigation

Support Host Network (--network host) mode on Docker Desktop for Mac and Windows #238

Tell us about your request

Which service(s) is this request for?

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?

Are you currently working around the issue?

Additional context

51 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Support Host Network (--network host) mode on Docker Desktop for Mac and Windows #238

Description

Tell us about your request

Which service(s) is this request for?

Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?

Are you currently working around the issue?

Additional context

Activity

Amondale commented on Sep 20, 2021

gramss commented on Mar 12, 2022

zfil commented on Mar 20, 2022

christophermclellan commented on Mar 30, 2022

wiredwiz commented on Jun 29, 2022

hexcowboy commented on Jul 29, 2022

ReubenFrankel commented on Oct 24, 2022

gramss commented on Nov 27, 2022

logical-and commented on Jan 6, 2023

jwoodrow commented on Jan 23, 2023

davidthornton commented on Jan 29, 2023

dewdrinker19 commented on Feb 11, 2023

51 remaining items

akerouanton commented on Apr 25, 2024

Nemesis7 commented on Apr 26, 2024

akerouanton commented on Apr 29, 2024

AndreKR commented on May 18, 2024

tangledhelix commented on May 18, 2024

AndreKR commented on May 18, 2024

tangledhelix commented on May 18, 2024

AndreKR commented on May 18, 2024

tangledhelix commented on May 18, 2024

s13n commented on Aug 5, 2024

akerouanton commented on Aug 5, 2024

s13n commented on Aug 6, 2024

akerouanton commented on Aug 6, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions