lima-vm / lima-vm/lima

host.lima.internal maybe not restrictive enough and incompatible with host-gateway docker(-compose) settings

Open
#450 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
21.9k
Forks
957
Avg merge
2d 6h
Merged PRs (30d)
53

Description

I use lima with docker by using your example install script (on a MacOS system):
https://github.com/lima-vm/lima/blob/master/examples/docker.yaml

I exposed the socket and everything (docker and docker-compose) runs nicely on my host machine.

Now i'm stumbled with some docker compose files which want to allow some container to connect to the host system.
Here I have an example with the important parts:
```
version: "3.2"
my-service:
hostname: my-service
extra_hosts:
- "host.docker.internal:host-gateway"
```

Even if this `host.docker.internal` hostname is set up in the container `/etc/hosts` file, it would not forward the request to my original host (which is the mac system).

It would work if I use `host.lima.internal` from within my container.
But this internal host seems to work in any case without any extra configuration.
I'm wondering if this is a good idea in regard to security. Because in most scenarios the services don't have to call the host system and should not be able to do so (IMHO).

I guess it would be really good if the `host-gateway` configuration with `host.docker.internal` would work. (which means redirect communication from the container to the host system (in my case to the mac host).
Then a lima user could use the same docker-compose definitions like everyone does, without any lima specific adjustments.

If this would work, then i'm wondering if such a solution could replace the proprietary `host.lima.internal` solution. Which would also have some security benefits IMHO.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.