Find a host address from inside a Docker container

If your goal is to reach a host service, use a supported host endpoint rather than searching for one universal “host IP.” A machine may have loopback, bridge, LAN, VPN, and public addresses, while Docker Desktop adds a VM networking layer.

Resolve host.docker.internal

Inside a Docker Desktop container, this hostname provides a host-access endpoint:

getent hosts host.docker.internal

The command requires getent in the image. A failed ping is not a reliable DNS or TCP-connectivity test because ICMP handling can differ. For application configuration, retaining the hostname is usually preferable to copying one resolved address permanently.

On Linux Engine 20.10 or later, create the container with an explicit mapping:

docker run --add-host host.docker.internal:host-gateway myapp:1.2

host-gateway uses the daemon's configured gateway substitution; it does not guarantee that the result is the host's LAN or public address. Legacy Desktop names such as docker.for.mac.localhost should not be the basis of a new configuration.

Inspect a gateway when the network model supports it

Inside a Linux container with the ip utility:

ip route show default

For an ordinary bridge network, the default gateway often corresponds to a host-side bridge interface. That is a useful observation, not a universal identity rule. Multiple networks can supply different gateways, and Desktop, rootless networking, overlay networks, or custom drivers may involve another virtual gateway.

If tools are missing, use the appropriate diagnostic image or install the distribution's iproute2 package only when modifying the container is acceptable. Do not hard-code 172.17.0.1 based on another machine's output.

Inspect from the daemon host

On a native Linux host where the default bridge exists:

ip addr show docker0
docker network ls
docker network inspect NETWORK_NAME

Replace NETWORK_NAME with the actual attachment. Network inspection shows configured subnets and gateways; the interface can be a custom bridge rather than docker0. With a remote Docker context, the daemon host is not necessarily the computer running the CLI.

Use the address with the correct listener

In a native bridge setup, a service bound only to the host's loopback does not accept traffic sent to its bridge address. Bind the intended reachable interface and permit only the required traffic. Desktop forwarding has its own behavior, so do not impose this native-Linux rule on every platform.

With native Linux host networking, the container shares the host network namespace and can use its loopback. The host still has other addresses; it is inaccurate to say its IP “becomes localhost.”

FAQ

How can a Kubernetes Pod identify its node address?

The Downward API can expose status.hostIP. That identifies a node address; it does not publish a service or prove a route through network policy.

Can I discover the host's public IP from the container?

An external IP-echo service reports the address that service sees. NAT, VPNs, proxies, and egress gateways can make it different from an address assigned to the host. If a particular advertised address is required, supply it explicitly through deployment configuration.

See Desktop networking, Docker networks, and host networking.