Docker Community Forums

Share and learn in the Docker community.

Cannot access the bare metal host local network from inside container

Anybody can assist on how to troubleshoot accessing bare metal host network from inside container. Container is on bridge network but cannot traverse outside of the container.

4a38e41d65de bridge bridge local
0bd74f52c419 host host local
7dc6f4a2a6bf none null local

Check your firewall rules.

Very good information Need to ask for advice


Host access With a container attached to a macvlan network, you will find that while it can contact other systems on your local network without a problem, the container will not be able to connect to your host (and your host will not be able to connect to your container). This is a limitation of macvlan interfaces: without special support from a network switch, your host is unable to send packets to its own macvlan interfaces.

Fortunately, there is a workaround for this problem: you can create another macvlan interface on your host, and use that to communicate with containers on the macvlan network.

First, I’m going to reserve an address from our network range for use by the host interface by using the --aux-address option to docker network create. That makes our final command line look like:

docker network create -d macvlan -o parent=eno1
–aux-address ‘host=’
This will prevent Docker from assigning that address to a container.

Next, we create a new macvlan interface on the host. You can call it whatever you want, but I’m calling this one mynet-shim:

ip link add mynet-shim link eno1 type macvlan mode bridge
Now we need to configure the interface with the address we reserved and bring it up:

ip addr add dev mynet-shim
ip link set mynet-shim up
The last thing we need to do is to tell our host to use that interface when communicating with the containers. This is relatively easy because we have restricted our containers to a particular CIDR subset of the local network; we just add a route to that range like this:

ip route add dev mynet-shim
With that route in place, your host will automatically use ths mynet-shim interface when communicating with containers on the mynet network.

Note that the interface and routing configuration presented here is not persistent – you will lose if if you were to reboot your host. How to make it persistent is distribution dependent