Networking features in Docker Desktop for Windows
Estimated reading time: 3 minutesDocker Desktop for Windows provides several networking features to make it easier to use.
Features
VPN Passthrough
Docker Desktop for Windows’s networking can work when attached to a VPN. To do this, Docker Desktop for Windows intercepts traffic from the containers and injects it into Windows as if it originated from the Docker application.
Port Mapping
When you run a container with the -p
argument, for example:
$ docker run -p 80:80 -d nginx
Docker Desktop for Windows makes whatever is running on port 80 in the container (in
this case, nginx
) available on port 80 of localhost
. In this example, the
host and container ports are the same. What if you need to specify a different
host port? If, for example, you already have something running on port 80 of
your host machine, you can connect the container to a different port:
$ docker run -p 8000:80 -d nginx
Now, connections to localhost:8000
are sent to port 80 in the container. The
syntax for -p
is HOST_PORT:CLIENT_PORT
.
HTTP/HTTPS Proxy Support
See Proxies.
Known limitations, use cases, and workarounds
Following is a summary of current limitations on the Docker Desktop for Windows networking stack, along with some ideas for workarounds.
There is no docker0 bridge on Windows
Because of the way networking is implemented in Docker Desktop for Windows, you cannot
see a docker0
interface on the host. This interface is actually within the
virtual machine.
I cannot ping my containers
Docker Desktop for Windows can’t route traffic to Linux containers. However, you can ping the Windows containers.
Per-container IP addressing is not possible
The docker (Linux) bridge network is not reachable from the Windows host. However, it works with Windows containers.
Use cases and workarounds
There are two scenarios that the above limitations affect:
I want to connect from a container to a service on the host
The host has a changing IP address (or none if you have no network access). From
18.03 onwards our recommendation is to connect to the special DNS name
host.docker.internal
, which resolves to the internal IP address used by the
host.
This is for development purpose and will not work in a production environment outside of Docker Desktop for Windows.
The gateway is also reachable as gateway.docker.internal
.
I want to connect to a container from Windows
Port forwarding works for localhost
; --publish
, -p
, or -P
all work.
Ports exposed from Linux are forwarded to the host.
Our current recommendation is to publish a port, or to connect from another container. This is what you need to do even on Linux if the container is on an overlay network, not a bridge network, as these are not routed.
The command to run the nginx
webserver shown in Getting Started
is an example of this.
$ docker run -d -p 80:80 --name webserver nginx
To clarify the syntax, the following two commands both publish container’s port 80
to host’s port 8000
:
$ docker run --publish 8000:80 --name webserver nginx
$ docker run -p 8000:80 --name webserver nginx
To publish all ports, use the -P
flag. For example, the following command
starts a container (in detached mode) and the -P
flag publishes all exposed ports of the
container to random ports on the host.
$ docker run -d -P --name webserver nginx
See the run command for more details on
publish options used with docker run
.