Connect from a container to a port on its host

To connect from a container to a service on the Docker host, use a reachable host address and the service's actual port. On Docker Desktop, host.docker.internal is the usual hostname. On native Linux Engine, an explicit host-gateway mapping is commonly used.

Connect with the right protocol

For MySQL on the host, use a MySQL client inside the container:

mysql --host=host.docker.internal --port=3306 --user=app --password

The client prompts for the password. An HTTP request to port 3306 does not validate the MySQL protocol. If the service is actually HTTP, a command such as curl --fail http://host.docker.internal:8000/ is appropriate instead. Both examples require the corresponding client executable.

On Linux Engine 20.10 or later, create the container with the mapping:

docker run -d --add-host host.docker.internal:host-gateway myapp:1.2

Or configure Compose:

services:
  app:
    image: myapp:1.2
    extra_hosts:
      - "host.docker.internal:host-gateway"

The host is the Docker daemon's host. When your CLI controls a remote daemon, it is not necessarily the laptop where you typed the command.

Check listener and route separately

For a conventional rootful Linux bridge setup, a host process bound only to 127.0.0.1 does not accept traffic addressed to the bridge-facing host IP. Bind it to the intended reachable interface and permit the required traffic through the host firewall. Binding 0.0.0.0 widens exposure and is not the only possible fix.

You can inspect a native Linux host's bridge address with ip addr show docker0 when that bridge exists. Its address is configurable; rootless Engine and Docker Desktop have different networking arrangements. Desktop's host forwarding should not be reduced to the same universal loopback-binding rule.

Check these independently: name resolution, the chosen address, a listening socket, the network path, authentication, and the application protocol. A successful ping proves none of the last three.

The reverse direction uses a different mechanism

To let a host client reach an HTTP server in a container:

docker run -d --name web -p 127.0.0.1:8080:80 nginx:stable

The local host then uses port 8080. Publishing the application's container port does not help that application reach a separate service on the host.

FAQ

Is host networking another option?

Native Linux host networking shares the host network namespace and permits host-loopback access. Docker Desktop 4.34+ provides an opt-in feature with its own limitations. Review isolation and port conflicts before adopting it; see the localhost guide.

How does a Kubernetes Pod reach a node service?

Use a reachable node address with suitable policy, or represent the dependency through an appropriate Service design. status.hostIP can identify the node hosting the Pod; it does not itself open a port or grant access.

Is this a good long-term dependency model?

It can fit a deliberate deployment, but host coupling complicates rescheduling. A stable service endpoint or managed database address often makes the dependency clearer.

See Desktop networking and host networking.