<p>Docker does not allow to connect a container to the host network and any other Docker bridge network at the same time. I will try to illustrate the reason with an example:</p>

<ul>
<li>Let us think of a container C1. Hypothetically, C1 would be connected to the host network (--net=host) and a Docker bridge network Br1 (--net=Br1).</li>
<li>A second container, let us say C2, is connected to Br1.</li>
</ul>

<p>With the above setup, my guess is that the host network is visible from C2, and I suppose this is the reason why Docker automatically prevents us from unintentionally exposing the host network to non-host-specified containers.</p>

<p>That being said, if we have a set of containers, and we want all of them to be interconnected, with just a single container having access to the host network, my approach would be:</p>

<ul>
<li>[C2,...,CN] are connected to a user-defined Docker bridge Br1 (--net=Br1)</li>
<li>C1 is connected to the host network (--net=host)</li>
<li>C1 exposes a port in order to be accessible from the rest of containers</li>
</ul>

<p>EDIT: We would still have to adapt iptables policies in such a way that C1 can be reached from the rest of containers (see <a href="https://docs.docker.com/network/iptables/" rel="noreferrer">https://docs.docker.com/network/iptables/</a>)</p>

CC BY-SA 4.0
2019-11-21T15:33:23.863Z
2019-11-21T16:05:10.900Z
2019-11-21T16:05:10.900Z
JJFanFer
<p>According to this <a href="https://github.com/docker/compose/issues/2844" rel="nofollow noreferrer">Q&amp;A on github</a>:</p>

<blockquote>
  <p>The host network is special. You have to use network_mode: host on the
  service</p>
</blockquote>

CC BY-SA 4.0
2019-11-19T03:30:54.230Z
The `network_mode` doesn't work if you need something connected to an internal network and the host network. It seems insane that we can't find a good clear solution to this problem.
jv-dev
CC BY-SA 3.0
2017-09-01T12:15:43.290Z
2017-09-01T12:15:43.290Z
030
<p>I am trying to run a Docker container as a router between a private (<code>--internal</code>) Docker network and the predefined <code>host</code> network. This means the container needs to have two network interfaces: One "outside" interface, that can access all host IP addresses, and one "inside" interface, that acts as a gateway for the containers in the internal Docker network</p>

<p>The router container itself will then NAT network traffic from/to containers.</p>

<p>I have not found a way to configure Docker to run the container with those two interfaces. The closest I could get is having two <code>bridge</code> interfaces assigned, which is not exactly what I need.</p>

<p>Trying to connect manually results in an error:</p>

<pre><code># docker network connect host root_router_1
Error response from daemon: Container cannot be disconnected from host network or connected to host network
</code></pre>

<p>Can anybody show me how to achieve this, preferably even whith Docker Compose?</p>

CC BY-SA 3.0
2018-04-09T07:37:43.630Z
@PunMum Unfortunately not. We ended up connecting all containers directly to the host network and configuring the IPs inside the containers.
Hexaholic
<docker><docker-compose>
Connect Docker container to both host and internal bridge network
Hexaholic
# Connect Docker container to both host and internal bridge network

(Asked by: username_0 on 2017-06-23)

I am trying to run a Docker container as a router between a private (--internal) Docker network and the predefined host network. This means the container needs to have two network interfaces: One "outside" interface, that can access all host IP addresses, and one "inside" interface, that acts as a gateway for the containers in the internal Docker network
The router container itself will then NAT network traffic from/to containers.
I have not found a way to configure Docker to run the container with those two interfaces. The closest I could get is having two bridge interfaces assigned, which is not exactly what I need.
Trying to connect manually results in an error:
# docker network connect host root_router_1
Error response from daemon: Container cannot be disconnected from host network or connected to host network

Can anybody show me how to achieve this, preferably even whith Docker Compose?

**Tags:** docker, docker-compose

> **Comments:**
> **username_0**: @PunMum Unfortunately not. We ended up connecting all containers directly to the host network and configuring the IPs inside the containers.  

---

## 2 answers

### Answer by username_1 on 2019-11-21. Score: 5

Docker does not allow to connect a container to the host network and any other Docker bridge network at the same time. I will try to illustrate the reason with an example:

* Let us think of a container C1. Hypothetically, C1 would be connected to the host network (--net=host) and a Docker bridge network Br1 (--net=Br1).
* A second container, let us say C2, is connected to Br1.

With the above setup, my guess is that the host network is visible from C2, and I suppose this is the reason why Docker automatically prevents us from unintentionally exposing the host network to non-host-specified containers.

That being said, if we have a set of containers, and we want all of them to be interconnected, with just a single container having access to the host network, my approach would be:

* [C2,...,CN] are connected to a user-defined Docker bridge Br1 (--net=Br1)
* C1 is connected to the host network (--net=host)
* C1 exposes a port in order to be accessible from the rest of containers

EDIT: We would still have to adapt iptables policies in such a way that C1 can be reached from the rest of containers (see <https://docs.docker.com/network/iptables/>)


---

### Answer by username_2 on 2017-09-01. Score: 3

According to this [Q&A on github](https://github.com/docker/compose/issues/2844):

> The host network is special. You have to use network\_mode: host on the
> service

> **Comments:**
> **username_3**: The `network_mode` doesn't work if you need something connected to an internal network and the host network. It seems insane that we can't find a good clear solution to this problem.  

---

