cloudflare / cloudflare/workers-sdk

Container/Sandbox outbound HTTP broken on Docker Desktop for Linux (wrangler ≥4.73)

Open
#13,082 6 comments 1 reaction 2 assignees Claimed by @MattieTK View on GitHub
package:wrangler upstream:workerd
Dominant language
TypeScript
Stars
4.5k
Forks
1.5k
Avg merge
3d 8h
Merged PRs (30d)
186

Description

### What versions & operating system are you using?

wrangler ≥4.73
Ubuntu 24.04

### Describe the Bug

I've been hitting broken outbound HTTP from containers/sandboxes on Docker Desktop for Linux since upgrading past wrangler 4.72. With the help of Claude Code, I did some root cause analysis.

It appears the `proxy-everything` egress sidecar resolves `host.docker.internal` to `192.168.65.2` (Docker Desktop VM IP), but workerd seems to bind the egress listener to `172.17.0.1` (docker bridge). We suspect these are different, unreachable IPs on Docker Desktop for Linux.

Sidecar logs show:
```
error: connecting to origin: dialing gateway: dial tcp 192.168.65.2:45437: connect: connection refused
```

While on the host, workerd appears to listen on the bridge:
```
LISTEN 0 4096 172.17.0.1:45437 0.0.0.0:* users:(("workerd",...))
```

This affects all container/sandbox outbound HTTP.

- **Works:** wrangler 4.72 on Docker Desktop for Linux
- **Breaks:** wrangler ≥4.73 on Docker Desktop for Linux
- **Also works:** Any wrangler version with native Docker Engine

### Please provide any relevant error logs

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.