rootless host.docker.internal dont work

[iambadwithname]

I'm not sure but i cant get host.docker.internal to work in root less
the only way I have to access my local service is via unix pipe or external routing
Am i doing something wrong?

[christianalberto]

In Docker rootless mode on Linux, host.docker.internal is not automatically resolved out of the box because networking is managed via RootlessKit / slirp4netns rather than the standard docker0 bridge.

To make host.docker.internal resolve correctly to your host machine in rootless mode, you have two primary solutions:

---

Solution 1: Use host-gateway (Recommended)

You can explicitly map host.docker.internal to the host gateway using the --add-host flag or extra_hosts in Compose.

Using Docker CLI:

docker run --add-host=host.docker.internal:host-gateway -it your-image
Using Docker Compose (docker-compose.yml):

YAML
version: '3.8'

services:
  your-service:
    image: your-image
    extra_hosts:
      - "host.docker.internal:host-gateway"
Solution 2: Manual IP Resolution for RootlessKit
If host-gateway does not resolve under your specific RootlessKit setup, you can manually point host.docker.internal to the default RootlessKit internal gateway IP:

In default RootlessKit (slirp4netns), the host interface inside the container namespace is typically mapped to 10.0.2.2 (or 172.17.0.1 depending on network driver version).

Add it directly:

YAML
extra_hosts:
  - "host.docker.internal:10.0.2.2"
Important Note on Host Firewalls (UFW / iptables)
If your container can resolve the IP but still gets connection refused, make sure your host service is listening on 0.0.0.0 or 127.0.0.1 (and that your firewall/UFW isn't blocking traffic from the RootlessKit interface range 10.0.2.0/24).

If this resolves your issue, please mark this response as the accepted answer so it can help others in the community! 🟢

[iambadwithname]

Sorry for not rep(I didn't know I have to reload the page).
I still cant acess local service over --add-host=host.docker.internal:host-gateway
I did disable sudo nft flush ruleset
here is my test
test.zip

[christianalberto]

Looking at your update, the reason --add-host=host.docker.internal:host-gateway still fails in Rootless mode is usually because host-gateway resolves to your host's primary LAN IP (e.g., 192.168.x.x), whereas your local service is likely listening strictly on 127.0.0.1 / localhost.

Here is how to solve it based on your setup:

---

Option 1: Bind your host service to 0.0.0.0 (Recommended)

Make sure the local service running on your host machine is bound to 0.0.0.0 instead of 127.0.0.1.

• If your service only listens on 127.0.0.1, RootlessKit cannot forward traffic coming from the container namespace to host-gateway.

---

Option 2: Target the RootlessKit Gateway directly (10.0.2.2)

If you cannot change your host service binding from 127.0.0.1, map host.docker.internal directly to 10.0.2.2 (the default slirp4netns tap gateway in Rootless mode):

# docker-compose.yml
services:
  your-service:
    image: your-image
    extra_hosts:
      - "host.docker.internal:10.0.2.2"

Option 3: Use Host Networking Mode
In Rootless Docker, network_mode: host is unprivileged and safely shares the host network namespace:

services:
  your-service:
    image: your-image
    network_mode: "host"

(With network_mode: host, your container can reach 127.0.0.1: directly on the host).

Quick Debugging Command
Inside your running container, test which endpoint responds:

# Test RootlessKit tap gateway
docker exec -it <container_id> curl -v [http://10.0.2.2](http://10.0.2.2):<YOUR_PORT>