32

I really don't understand what's going on here. I just simply want to perform a http request from inside one docker container, to another docker container, via the host, using the host's public ip, on a published port.

Here is my setup. I have my dev machine. And I have a docker host machine with two containers. CONT_A listens and publishes a web service on port 3000.

DEV-MACHINE

HOST (Public IP = 111.222.333.444)
  CONT_A (Publish 3000)
  CONT_B

enter image description here

On my dev machine (a completely different machine)

I can curl without any problems

curl http://111.222.333.444:3000 --> OK

When I SSH into the HOST

I can curl without any problesm

curl http://111.222.333.444:3000 --> OK

When I execute inside CONT_B

Not possible, just timeout. Ping is fine though...

docker exec -it CONT_B bash
$ curl http://111.222.333.444:3000 --> TIMEOUT
$ ping 111.222.333.444 --> OK

Why?

Ubuntu 16.04, Docker 1.12.3 (default network setup)

6
  • I'm thinking this is probably because of how Docker handles networking using IPTables & Bridge Network. I'll have to look it up but I'm guessing the IP address you're giving is probably the IP address seen from the host, not the "internal IP" assigned within the docker network. Reason ping might resolve is because it resolves to the docker host (not the container). But the docker way of achieving this is to not publish the port in container A but instead make an overlay network docs.docker.com/engine/userguide/networking.
    – Rik Nauta
    Dec 15, 2016 at 20:07
  • 4
    @RikNauta The IP address I'm using is the public host ip. Surely that should always resolve correctly unless it's somehow conflicting with the internal docker network. It's a 104.... ip address.
    – pqvst
    Dec 15, 2016 at 20:19
  • That should work. There's a userland proxy process docker runs to listen on the host and forward the tcp connection into the container. Does the same work in Docker 1.11? Do you have userland-proxy set to false on the docker daemon?
    – Matt
    Dec 16, 2016 at 4:57
  • @Matt I haven't tested Docker 1.11 and I'm not sure about userland-proxy. I haven't touched it so I'm assuming it's default. Interestingly when I googled "userland-proxy" I found this github.com/docker/docker/issues/21860
    – pqvst
    Dec 16, 2016 at 8:41
  • 1
    @BMitch talking directly between containers on the internal docker network wouldn't work in a situation where the services communicate via ssl/tls and the certificates are made for the full URL like "mysite.com", for instance when using letsencrypt which prohibits IPs and anything it can't reach via dns. If your service needs to be externally reachable by other services than this design means the other docker container has to live on a separate server. Frustrating! What is the solution for a single production server running a dockerized microservices architecture?
    – Nick
    Aug 9, 2022 at 1:43

4 Answers 4

10

I know this isn't strictly answer to the question but there's a more Docker-ish way of solving your problem. I would forget about publishing the port for inter-container communication altogether. Instead create an overlay network using docker swarm. You can find the full guide here but in essence you do the following:

//create network    
docker network create --driver overlay --subnet=10.0.9.0/24 my-net
//Start Container A
docker run -d --name=A --network=my-net producer:latest
//Start Container B
docker run -d --name=B --network=my-net consumer:latest

//Magic has occured
docker exec -it B /bin/bash
> curl A:3000 //MIND BLOWN!

Then inside container be you can just curl hostname A and it will resolve for you (even when you start doing scaling etc.)

If you're not keen on using Docker swarm you can still use Docker legacy links as well:

docker run -d --name B --link A:A consumer:latest

which would link any exposed (not published) ports in your A container.

And finally, if you start moving to production...forget about links & overlay networks altogether...use Kubernetes :-) Bit more difficult initial setup but they introduce a bunch of concepts & tools to make linking & scaling clusters of containers a lot easier! But that's just my personal opinion.

1
  • 4
    It doesn't even need to be an overlay network when you're on a single host, the default bridge driver will work file.
    – BMitch
    Dec 15, 2016 at 23:04
4

By running your container B with --network host argument, You can simply access your container A using localhost, no public ip needed.

> docker run -d --name containerB --network host yourimagename:version

After you run container B with above command then you can try curl container A from container B like this

> docker exec -it containerB /bin/bash
> curl http://localhost:3000
4
+100

None of the current answers explain why the docker containers behave like described in the question

Docker is there to provide a lightweight isolation of the host resources to one or several containers.

The Docker network is by default isolated from the host network, and use a bridge network (again, by default; you have have overlay network) for inter-container communication.

https://docs.docker.com/engine/tutorials/bridge1.png

and how to fix the problem without docker networks.

From "How to connect to the Docker host from inside a Docker container?"

As of Docker version 18.03, you can use the host.docker.internal hostname to connect to your Docker host from inside a Docker container.

This works fine on Docker for Mac and Docker for Windows, but unfortunately, this is not was not supported on Linux until Docker 20.10.0was released in December 2020.

Starting from version 20.10 , the Docker Engine now also supports communicating with the Docker host via host.docker.internal on Linux.
Unfortunately, this won't work out of the box on Linux because you need to add the extra --add-host run flag:

--add-host=host.docker.internal:host-gateway

This is for development purpose and will not work in a production environment outside of Docker Desktop for Windows/Mac.

That way, you don't have to change your network driver to --network=host, and you still can access the host through host.docker.internal.

4
  • Thx for the answer! What I still don't understand is, why does the container behave different if the target of a public domain name is the own host or another server? I outlined my setup and logs in detail here: github.com/ONLYOFFICE/Docker-DocumentServer/issues/…
    – RoBeaToZ
    Feb 26, 2022 at 22:18
  • @RoBeaToZ Because the all idea behind a container is to believe it is its "own machine", which implies not seeing by default the host resources (CPU, disk, network).
    – VonC
    Feb 26, 2022 at 22:34
  • 1
    I understand that. In this case, container B tries to reach the service behind HOST_PUBLIC_IP:300. It feels intuitive for me, that it should not matter if this service runs on another server, in an AWS cloud or in a container on the same host. It may vary in different environments. Container B does not have this information and has to handle the latter case in a special way, which feels unintuitive for me.
    – RoBeaToZ
    Feb 26, 2022 at 23:52
  • @RoBeaToZ unintuitive indeed, but consistent with the mission of a container: being in its own ecosystem, unaware of any "external" (external for the container and its own network) "public" IP.
    – VonC
    Feb 27, 2022 at 0:40
3

I had a similar problem, I have a nginx server in one container (lets call it web) with several server blocks, and cron installed in another container (lets call it cron). I use docker compose. I wanted to use curl from cron to web from time to time to execute some php script on one of the application. It should look as follows:

curl http://app1.example.com/some_maintance.php

But I always was getting host unreachable after some time.

First solution was to update /etc/hosts in cron container, and add:

1.2.3.4 app1.example.com

where 1.2.3.4 is the ip for web container, and it worked - but this is a hack - also as far as I know such manual updates are not encouraged. You should use extra_hosts in docker compose, which requires explicit ip address instead of name of container to specify IP address.

I tried to use custom networks solution, which as I have seen is the correct way to deal with this, but I never succeeded here. If I ever learn how to do this I promise to update this answer.

Finally I used curl capability to specify IP address of the server, and I pass domain name as a header in separate parameter:

curl -H'Host: app1.example.com' web/some_maintance.php

not very beautiful but does work.

(here web is the name of my nginx container)

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.