host.lima.internal maybe not restrictive enough and incompatible with host-gateway docker(-compose) settings
- Dominant language
- Go
- Stars
- 21.9k
- Forks
- 957
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 53
Description
I use lima with docker by using your example install script (on a MacOS system):
https://github.com/lima-vm/lima/blob/master/examples/docker.yaml
I exposed the socket and everything (docker and docker-compose) runs nicely on my host machine.
Now i'm stumbled with some docker compose files which want to allow some container to connect to the host system.
Here I have an example with the important parts:
```
version: "3.2"
my-service:
hostname: my-service
extra_hosts:
- "host.docker.internal:host-gateway"
```
Even if this `host.docker.internal` hostname is set up in the container `/etc/hosts` file, it would not forward the request to my original host (which is the mac system).
It would work if I use `host.lima.internal` from within my container.
But this internal host seems to work in any case without any extra configuration.
I'm wondering if this is a good idea in regard to security. Because in most scenarios the services don't have to call the host system and should not be able to do so (IMHO).
I guess it would be really good if the `host-gateway` configuration with `host.docker.internal` would work. (which means redirect communication from the container to the host system (in my case to the mac host).
Then a lima user could use the same docker-compose definitions like everyone does, without any lima specific adjustments.
If this would work, then i'm wondering if such a solution could replace the proprietary `host.lima.internal` solution. Which would also have some security benefits IMHO.
Contributor guide
Assessment
This issue has not been assessed yet.