starred/container
1
0
Fork 0
mirror of https://github.com/apple/container.git synced 2026-09-28 01:46:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

Container-to-host networking. (#1078)

Browse Source 
- Closes #346.
- This PR enables connecting host's localhost ports from
  containers.
- It adds an option `--localhost <localhost>` to DNS
  create command, after which the packets heading
  ip address in container are redirected to localhost in
  host machine. Packet filter rule is added and deleted
  along with the creation and deletion of localhost domain.
This commit is contained in:
jwhur
2026-01-23 17:59:28 -08:00
committed by GitHub
parent 14c279fcd2
commit ed1185d489
11 changed files with 616 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/technical-overview.md
-12
View File
@@ -52,18 +52,6 @@ When `container-apiserver` starts, it launches an XPC helper `container-core-ima
With the initial release of `container`, you get basic facilities for building and running containers, but many common containerization features remain to be implemented. Consider [contributing](../CONTRIBUTING.md) new features and bug fixes to `container` and the Containerization projects!
### Container to host networking
In the initial release, there is no way to route traffic directly from a client in a container to a host-based application listening on the loopback interface at 127.0.0.1. If you were to configure the application in your container to connect to 127.0.0.1 or `localhost`, requests would simply go to the loopback interface in the container, rather than your host-based service.
You can work around this limitation by configuring the host-based application to listen on the wildcard address 0.0.0.0, but this practice is insecure and not recommended because, without firewall rules, this exposes the application to external requests.
A more secure approach uses `socat` to redirect traffic from the container network gateway to the host-based service. For example, to forward traffic for port 8000, configure your containerized application to connect to `192.168.64.1:8000` instead of `127.0.0.1:8000`, and then run the following command in a terminal on your Mac to forward the port traffic from the gateway to the host:
```bash
socat TCP-LISTEN:8000,fork,bind=192.168.64.1 TCP:127.0.0.1:8000
```
### Releasing container memory to macOS
The macOS Virtualization framework implements only partial support for memory ballooning, which is a technology that allows virtual machines to dynamically use and relinquish host memory. When you create a container, the underlying virtual machine only uses the amount of memory that the containerized application needs. For example, you might start a container using the option `--memory 16g`, but see that the application is only using 2 GiBytes of RAM in the macOS Activity Monitor.