Hitting resources in a private network from within a Docker container using VPN

Question

I'm running Docker 1.9.1 on OSX, and I'm connected to my private work network with Cisco AnyConnect VPN. A service that I'm running in a Docker container connects to a DB within the work network, and is unreachable from within the container, but reachable from outside the container in OSX. It's also reachable from within the container if I'm connected directly to the work network, not through VPN. I suspect I may have to do some network configuration with the docker-machine VM, but I'm not sure where to go from here.

Answer 1

If you are using Virtualbox as your hypervisor for the docker-machines, I suggest you set your network mode as Bridged Adapter. This way your VM will be connected to the network individually just like your own machine. Also to gather more information for troubleshooting try pinging the db host machine from the container machine command line. use docker exec -it <container-name> /bin/bash

Answer 2

Check your routing inside the Docker Machine VM with

docker-machine ssh default
$ route -n

which looks like this on a fresh machine:

docker@default:~$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.2.2 0.0.0.0 UG 1 0 0 eth0 10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 lo 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 192.168.99.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

If you've created a lot of networks, i.e. by using docker-compose it might have created routes to stacks, which conflict with your VPN or local network routes.

docker@dev15:~$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 10.0.2.2 0.0.0.0 UG 1 0 0 eth0 10.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 127.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 lo 172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0 172.18.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-7400365dbd39 172.25.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-4db568a601b4 [...] 192.168.80.0 0.0.0.0 255.255.240.0 U 0 0 0 br-97690a1b4313 192.168.105.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

TL;dr

It should be safe to remove all networks, with

docker network rm $(docker network ls -q)

since active networks are not removed by default ... but nonetheless be careful when running rm commands :)