Docker dev container not working properly with net host mode on mac

[mbrandenburger]

Describe the bug

Currently we start the FPC docker dev container with --net host as set in utils/docker/Makefile to allow easy access to services (e.g. demo mock server and other docker-compose based tests). This seems to work fine on Linux but is not supported for Mac.

For instance, when starting the demo mock server on port 5000, this is not reachable via browser from the host Mac system.

The host networking driver only works on Linux hosts, and is not supported on Docker Desktop for Mac, Docker Desktop for Windows, or Docker EE for Windows Server.

See Use host networking at docker docs.

To Reproduce
On a Mac

cd $FPC_PATH/utils/docker
make run

inside the container

make
cd  $FPC_PATH/demo/client/backend/mock/
make run-fpc

Expected behavior
open a browser and check localhost:3000; and you should see 404 page not found error. 404 shows that the web service inside the container can be accessed from the host.

Environment (please complete the following information):

• OS: Mac
• FPC Version: master

Workaround

Start the container without --net=host and add port mapping using -p 3000:3000.

@g2flyer Can we change DOCKER_DEV_RUN_OPTS in a way that the use of --net=host can be controlled easily though config.override.mk? Or just remove --net=host as default?

[g2flyer]

Hmm, seems almost as if --net=host on mac does the opposite than on linux.

On linux it was needed such that the dev container got access to the services exposed by the docker-compose network to the host (as otherwise the container wouldn't have seen them). As far as i remember this was not an issue on mac where ports exposed to host were also visible in dev container without --net=host ("easy" test: check that make -C demo/client/scripting test works properly on mac also without --net=host) but adding --net=host made that still work (at least assuming/hoping you do run make on top-level to test your PRs ;-)

Now from what you say, it seems as if --net=host on Mac does not anymore expose container ports to host whereas it did before?

btw: i'm actually surprised that docker on mac would by default expose any ports to host: Isn't issue more that currently make run doesn't expose any ports? In which case i guess we just would have to add the port-range we want on guest. Otherwise, lets just skip the addition of -net=host iff the os is a Mac (with os figured out, e.g., via uname ..)

[mbrandenburger]

starting the dev container without --net=host the integration tests fail. In particular, in the deployment test, when the marble chaincode is built using the docker build container of fabric cannot be accessed from within the dev container, thus, the test fails. The reason is, that the build container is indeed created on the host but cannot be accessed from the peer (running inside the dev container). With --net=host this works nicely.

[g2flyer]

Some discussion around --net=host and mac can be found in https://forums.docker.com/t/should-docker-run-net-host-work/14215 including some workarounds like port-forwarding and alike to the vm running docker host.

I wonder, though, in the normal setup (with --net=host), isn't the mock-server's port maybe exposed on the docker daemon vm? In that case it should work by just replacing in the browser localhost/127.0.0.1 with the ip/hostname of the docker daemon vm?