Reach a host service from a Docker container

Inside an ordinary bridge-networked container, localhost refers to that container. To reach a service on the Docker host, use an address reachable from the container, usually host.docker.internal on Docker Desktop.

Docker Desktop

For an HTTP service listening on host port 8000, run this inside a container that has curl installed:

curl --fail http://host.docker.internal:8000/

Docker Desktop supplies this hostname. It routes through Desktop's networking implementation rather than treating the container's loopback interface as the host's. For MySQL, use a MySQL client or a TCP connectivity check; HTTP curl against port 3306 is not a valid database test.

Docker Engine on Linux

On an Engine version supporting host-gateway (20.10 or later), add an explicit host mapping when creating the container:

docker run -d --add-host host.docker.internal:host-gateway myapp:latest

The Compose equivalent is:

services:
  app:
    image: myapp:latest
    extra_hosts:
      - "host.docker.internal:host-gateway"

This maps a name to the daemon's configured host-gateway address; it does not make a loopback-only Linux service reachable through that address. Bind the service to the appropriate host interface and allow the required container traffic through the firewall. Avoid exposing it on every interface merely to bypass a routing problem.

When host networking fits

On Linux, this shares the host's network namespace:

docker run -d --network host myapp:latest

Here, the container can use the host's loopback services. Ports share the host's namespace, so conflicts are possible and -p publishing is unnecessary. Docker Desktop 4.34 and later also offers opt-in host networking, with TCP/UDP support and platform-specific limitations; it is not identical to native Linux namespace sharing. It supports Linux containers, not Windows containers.

FAQ

Why does the hostname fail on Linux?

Desktop's automatic name is not a universal Engine default. Check the explicit mapping, daemon version, and selected Docker context. An older daemon may reject host-gateway; use a verified reachable address or upgrade.

Can I use the bridge gateway directly?

Yes, when it is the correct host address for that network. Do not assume every installation uses 172.17.0.1, or that the default gateway is always the physical host. Desktop, rootless engines, and remote contexts differ.

What is the Kubernetes equivalent?

A Pod can reach a node service through a reachable node address and appropriate network policy. hostNetwork changes isolation and requires deliberate use. A Service without a selector plus suitable EndpointSlices can represent an external service; ExternalName only provides a DNS alias. hostPort publishes a Pod port on a node and is not a general solution for reaching an existing node service.

See Desktop networking, host networking, and the run reference.