Note: I posted this on SO (question 43879637) but I believe that question should be closed and reference this one since, in fact, it is not a programming issue.
Network Mode: Host
If network mode is host, there should be no problem, but then network isolation is not in place and each container is like a service in one server, they cannot share ports, they have all the same ip address, which is the address of the host.
In Docker Compose:
networks:
my-network:
driver: host
Network Mode: Bridge
A better approach is to use the bridge network, which emulates a local network where each container has its own IP address.
In Docker Compose:
networks:
my-network:
driver: bridge
If you have multiple bridge networks, sometimes iptables or route tables are not properly maintained by docker, as discussed in many articles / forums:
https://stackoverflow.com/questions/66067893/why-does-docker-give-error-connect-no-route-to-host-when-trying-to-connect-to
You will find that docker0 was the network interface linked to the first default bridge (172.17.0.0), and subsequent networks are associated to virtual devices such as br-d2938602303c, br-dfd44f0535bf...
Check changing iptables to accept incoming packets from all desired docker interfaces:
BEFORE
[root@my-server]# iptables -S INPUT
-P INPUT ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type 8 -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i docker0 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8000:9999 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 2100:2199 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
AFTER
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i docker0 -j ACCEPT
-A INPUT -i br-d2938602303c -j ACCEPT
-A INPUT -i br-dfd44f0535bf -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8000:9999 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 2100:2199 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
Then restart ip tables service
service iptables restart
Then I also fixed the routing table, which looks like this
[root@jupiter ~]# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default static.129.95.9 0.0.0.0 UG 0 0 0 eno1
static.129.95.9 0.0.0.0 255.255.255.255 UH 0 0 0 eno1
link-local 0.0.0.0 255.255.0.0 U 1002 0 0 eno1
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
172.18.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-d2938602303c
172.19.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-dfd44f0535bf
Useful links:
https://www.baeldung.com/linux/docker-connecting-containers-to-host
https://www.reddit.com/r/docker/comments/i5es7f/no_route_to_host_but_successful_google_ping/
https://stackoverflow.com/questions/66067893/why-does-docker-give-error-connect-no-route-to-host-when-trying-to-connect-to
https://stackoverflow.com/questions/43879637/docker-container-cannot-connect-to-host-machine-no-route-to-host/78041985#78041985
