How to allowfrom host.docker.internal?

[powerman]

I'm using Netdata which needs both network_mode: host and access to docker.
Because of this I have to publish socket-proxy port on localhost:

    ports:
      - "127.0.0.1:2375:2375" # Must publish on host because netdata uses "network_mode: host".
    command:
      - '-listenip=0.0.0.0'

But this result in -allowfrom check apply to docker's gateway IP (e.g. 172.16.0.1) for requests sent to 127.0.0.1 on the host.
As gateway IP may differ I don't like to hardcode it. I've tried this, but it doesn't work:

    ports:
      - "127.0.0.1:2375:2375" # Must publish on host because netdata uses "network_mode: host".
    extra_hosts:
      - "host.docker.internal:host-gateway"
    command:
      - '-listenip=0.0.0.0'
      - '-allowfrom=host.docker.internal'

Any ideas how to make it work without -allowfrom=0.0.0.0/0?

BTW, another issue is only first CIDR in allowfrom actually works:

• -allowfrom=0.0.0.0/0,127.0.0.1/32 - this WORKS
• -allowfrom=127.0.0.1/32,0.0.0.0/0 - this DOES NOT WORK

[wollomatic]

Hi @powerman,

maybe you could use a unix socket instead of a TCP connection? Works with traefik: https://github.com/wollomatic/socket-proxy/wiki#using-socket-instead-of-tcp-example-with-traefik

And thanks for reporting the "first CIDR works" bug. This will be fixed in the next release, see #105

[powerman]

Thanks, changed to socket, works fine.

The original question is probably still valid. When publishing port it may be important to distinguish between clients connecting to localhost (their real IP is 127.0.0.1 but it should be visible as gateway host.docker.internal IP to socket-proxy, I suppose) and clients connecting to some other IP of the host (should be visible as their real IP, I suppose).