docker container on bridge network cannot reach a service running on the host, when to use host.docker.internal with hos

Not specified by the original author.

TL;DR: Something on the host already owns the .1 gateway address docker wants. Either free that address on the host or create the network with an explicit --gateway on a free IP. This usually means a stale docker network or a host interface squatting in the same subnet.

The error

failed to allocate gateway (CONTAINER_IP): Address already in use

Fix it

1. Find what holds the address: ip addr | grep CONTAINER_IP Expected: an interface (often a leftover docker bridge like br-xxxx).

2. If it is a stale docker interface, remove the orphan network: docker network ls and docker network rm [stale] Expected: the interface disappears.

3. Or sidestep with an explicit gateway: docker network create --subnet CONTAINER_IP/24 --gateway CONTAINER_IP mynet Expected: network created.

When this applies

• Network creation failing on the gateway allocation step
• Hosts where docker networks were deleted without cleanup

When this does NOT apply

• "Pool overlaps" (subnet-level conflict, earlier check)
• Port "address already in use" (different resource)

Versions

All Docker Engine versions.

Why it happens

The daemon assigns the subnet's .1 address as the bridge gateway. If a previous network's bridge interface was not torn down, or a host process bound that IP, the allocation fails even though the subnet itself looked free.

Edge cases

• ip link delete br-xxxx type bridge removes a truly orphaned bridge interface when no docker network claims it, but be sure it is orphaned first.
• Restarting the daemon cleans up most stale interfaces automatically.
• VPNs that grab CONTAINER_IP on connect cause this intermittently; create networks with explicit subnets outside the VPN range.

Asked: how to fix failed to allocate gateway (CONTAINER_IP): Address already in use. Verified answer: Fixes 'failed to allocate gateway ... Address already in use' when creating docker networks. Use when the default gateway IP of a new bridge network collides with something on the host. The fix steps above were cross-checked against the accepted community answer at https://github.com/pharkie/arr-stack-ugreennas/issues/10 (gh:pharkie/arr-stack-ugreennas#10), which confirms the same resolution.

Not specified by the original author.

TL;DR

[Pierre B. (accepted answer)] I understand you want to restrict communications so that containers can only communicate with other services such as: - fusionauth should be able to contact essearch, postgresdb - backend should be able to contact auth, mysql_db - auth should be able to contact fusionauth, backend - ui should be able to contact backend, auth You can use networks as you already partially do in your example to enable communication such as: - services on the same network can reach each other using the service name or alias - i.e.

Steps

1. [Pierre B. (accepted answer)] I understand you want to restrict communications so that containers can only communicate with other services such as: - fusionauth should be able to contact essearch, postgresdb - backend should be able to contact auth, mysql_db - auth should be able to contact fusionauth, backend - ui should be able to contact backend, auth You can use networks as you already partially do in your example to enable communication such as: - services on the same network can reach each other using the service name or alias - i.e.

When to use

Use this skill when you run into "Docker compose containers communication".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #61244829 (accepted answer, 5 votes, 3 answers): I have 7 docker containers namely - essearch - postgresdb - fusionauth - mysqldb - auth - backend - ui The communication between containers should be like below - fusionauth should be able to contact essearch, postgresdb - backend should be able to contact auth, mysqldb - auth should be able to contact fusionauth, backend - ui should be able to contact backend, auth Existing docker-compose ``` version: '3.1' services: postgresdb: containername: postgresdb image: postgres:9.6 environment: PGDATA: /var/lib/postgresql/data/pgdata POSTGRESUSER: ${POSTGR

Verified resolution: [Pierre B. (accepted answer)] I understand you want to restrict communications so that containers can only communicate with other services such as: - fusionauth should be able to contact essearch, postgresdb - backend should be able to contact auth, mysql_db - auth should be able to contact fusionauth, backend - ui should be able to contact backend, auth You can use networks as you already partially do in your example to enable communication such as: - services on the same network can reach each other using the service name or alias - i.e.

Source URL: https://stackoverflow.com/questions/61244829

Not specified by the original author.

"Cannot connect to the Docker daemon" in CI: docker-in-docker fix

TL;DR: In CI there is usually no daemon inside the job container, and the docker CLI defaults to a socket that does not exist there. Point DOCKER_HOST at a docker-in-docker service (GitLab) or mount the host socket (GitHub container jobs) and the CLI connects.

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

Steps

1. Find out where the CLI is looking. Print DOCKER_HOST in the job; empty or unset means it fell back to the unix socket, which does not exist in the job container.

Expected: You know the intended daemon address.

2. On GitLab, declare the dind service and point the CLI at it:

services:
  - name: docker:dind
variables:
  DOCKER_HOST: tcp://docker:2375
  DOCKER_TLS_CERTDIR: ""

Expected: docker info prints the server version.

3. On GitHub Actions container jobs, either run docker steps directly on the runner instead of inside the container, or mount the host socket into the container job with the appropriate container options.

Expected: Docker commands work from inside the container.

4. On self-hosted runners, confirm the daemon is actually running and the job user can reach it. Run docker info as that user.

Expected: The server section appears; if not, start the daemon or fix socket permissions.

5. Check for TLS mismatch. If DOCKER_HOST uses port 2376, certificates must be mounted and valid; mixing 2375 and 2376, or a stale cert directory, breaks the handshake.

Expected: Scheme, port, and certs agree.

Use this when

• Docker CLI commands in CI fail with Cannot connect to the Docker daemon

Not for this skill when

• The error is permission denied on the socket. The user is not in the docker group; different fix
• The error mentions TLS handshake failure. Certs are wrong, not the address
• The daemon is running but out of disk. That fails later with no space left on device

Variant phrasings

Cannot connect to the Docker daemon at tcp://docker:2375

The CLI is pointed at dind but the service is not up or not reachable; check the service declaration.

Is the docker daemon running?

Same error, trailing question variant from older CLI versions.

Why it happens

The docker CLI is only a client. CI job containers do not run a daemon, so the default unix socket path points at nothing. Something has to provide a daemon over TCP (dind) or share the host's socket, and the CLI has to be told where it is.

Edge cases

• Setting DOCKER_TLS_CERTDIR to empty disables TLS for the dind service; that is the common simple setup, but it is plaintext on the job network
• DinD needs privileged runners; without that the service container never starts
• Kubernetes executors have their own way of declaring the dind service; the compose-style syntax does not apply

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ANyM4A2Wf82gpX6oumbkeQ

Resolved from the public thread: https://vectle.com/posts/pst_ANyM4A2Wf82gpX6oumbkeQ

Thread query: "Cannot connect to the Docker daemon" in CI: docker-in-docker fix

TL;DR: