Search code examples
dockerdocker-composehyper-vdocker-for-windows

Docker networks not exposed to host on Windows

I have a basic configuration for ngnix service and network in docker-compose.yml

version: '3'
services:
    nginx:
        build: ./docker/nginx
        networks:
            eznet:
                ipv4_address: 172.21.20.30
        ports:
            - 80:80
        volumes:
            - ./logs/nginx/:/var/log/nginx
            - ${APP_PATH}:/var/www/

networks:
    eznet:
        driver: bridge
        ipam:
            driver: default
            config:
                - subnet: 172.21.20.0/24

On Linux docker-compose will create virtual network interface in 172.21.20.x subnet, with ngnix accessible on 172.21.20.30. This is very usefull for my dev team, we are using it to organize multiple projects.

On Windows (Docker for Windows based on hyperV) after running docker-compose up -d no new network interfaces were created.

I've tried to change Docker deamon settings, I've added 

{
    "bridge": "none"
}

to daemon config, which was supposed to prevent docker from creating its default network (DockerNAT) and force it to expose all networks as interfaces visible on host, but nothing changed.

Is there any way to expose docker network on host with Docker for Windows?

Solution

  • Docker for Windows/Mac container networks are not accessible from the host.

    Docker creates it's networks on a bridge in an Alpine Linux virtual machine running in HyperV. These networks are not exposed to the VM host. The only network access to containers is via mapped TCP or UDP ports.

    There are ways to setup a VM that can be accessed but it generally involves using a custom VM rather than Docker for Windows/Mac (or Docker Machine), as the Docker virtual machines are not very customisable (they aim for ease of use/setup).

    1. Create a Docker VM with a network route to the host.

      Create an "external network switch" for the VM.

      On VirtualBox a bridged adaptor will do. It's possible to setup via a host only network adaptor as well, but can be a bit more complex as most containers need internet access, so need a second adaptor.

    2. Ping the Docker VM

      You should be able to ping the main interface of the VM from your host and vice versa

      C:\> ping 192.168.98.30

    3. Make sure IP routing is turned on in the Docker VM

      Add IP forwarding to sysctl (/etc/sysctl.d/99-sysctl.conf on Debian)

      net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1

      Then reload the sysctl files to pick up the config

      sysctl --system

    4. Add routes to private Docker networks via the VM

      Now tell your VM host how to get to the Docker networks. 

      route -p ADD 172.21.20.0 MASK 255.255.255.0 192.168.98.30

    I do this with Vagrant/Debian/VirtualBox mainly so apologies if the HyperV terminology is off. My Vagrant setup goes a step further by creating an entire bridge attached to the host only network so that containers can be attached to the bridge and directly accessed from the host.