Cannot access docker compose published ports in WSL2 from Windows

### Windows Version

Microsoft Windows [Version 10.0.26200.8457]

### WSL Version

WSL version: 2.7.3.0 Kernel version: 6.6.114.1-1 WSLg version: 1.0.73 MSRDC version: 1.2.6676 Direct3D version: 1.611.1-81528511 DXCore version: 10.0.26100.1-240331-1435.ge-release Windows version: 10.0.26200.8457

### Are you using WSL 1 or WSL 2?

- [x] WSL 2
- [ ] WSL 1

### Kernel Version

6.6.114.1-microsoft-standard-WSL2

### Distro Version

Debian GNU/Linux 13 (trixie)

### Other Software

Client:
Version: 29.4.3
API version: 1.54
Go version: go1.26.2
Git commit: 055a478
Built: Wed May 6 17:06:42 2026
OS/Arch: linux/amd64
Context: default

Server: Docker Desktop 4.73.1 (226574)
Engine:
Version: 29.4.3
API version: 1.54 (minimum version 1.40)
Go version: go1.26.2
Git commit: 56be731
Built: Wed May 6 17:07:37 2026
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v2.2.3
GitCommit: 77c84241c7cbdd9b4eca2591793e3d4f4317c590
runc:
Version: 1.3.5
GitCommit: v1.3.5-0-g488fc13e
docker-init:
Version: 0.19.0
GitCommit: de40ad0
Client:
Version: 29.4.3
Context: default
Debug Mode: false
Plugins:
agent: Docker AI Agent Runner (Docker Inc.)
Version: v1.54.0
Path: /usr/local/lib/docker/cli-plugins/docker-agent
ai: Docker AI Agent - Ask Gordon (Docker Inc.)
Version: v1.20.2
Path: /usr/local/lib/docker/cli-plugins/docker-ai
buildx: Docker Buildx (Docker Inc.)
Version: v0.33.0-desktop.1
Path: /usr/local/lib/docker/cli-plugins/docker-buildx
compose: Docker Compose (Docker Inc.)
Version: v5.1.3
Path: /usr/local/lib/docker/cli-plugins/docker-compose
debug: Get a shell into any image or container (Docker Inc.)
Version: 0.0.47
Path: /usr/local/lib/docker/cli-plugins/docker-debug
desktop: Docker Desktop commands (Docker Inc.)
Version: v0.3.0
Path: /usr/local/lib/docker/cli-plugins/docker-desktop
dhi: CLI for managing Docker Hardened Images (Docker Inc.)
Version: v0.0.3
Path: /usr/local/lib/docker/cli-plugins/docker-dhi
extension: Manages Docker extensions (Docker Inc.)
Version: v0.2.31
Path: /usr/local/lib/docker/cli-plugins/docker-extension
init: Creates Docker-related starter files for your project (Docker Inc.)
Version: v1.4.0
Path: /usr/local/lib/docker/cli-plugins/docker-init
mcp: Docker MCP Plugin (Docker Inc.)
Version: v0.42.0
Path: /usr/local/lib/docker/cli-plugins/docker-mcp
model: Docker Model Runner (Docker Inc.)
Version: v1.1.37
Path: /usr/local/lib/docker/cli-plugins/docker-model
offload: Docker Offload (Docker Inc.)
Version: v0.5.85
Path: /usr/local/lib/docker/cli-plugins/docker-offload
pass: Docker Pass Secrets Manager Plugin (beta) (Docker Inc.)
Version: v0.0.25
Path: /usr/local/lib/docker/cli-plugins/docker-pass
sandbox: (Docker Inc.)
Version: v0.12.0
Path: /usr/local/lib/docker/cli-plugins/docker-sandbox
sbom: View the packaged-based Software Bill Of Materials (SBOM) for an image (Anchore Inc.)
Version: 0.6.0
Path: /usr/local/lib/docker/cli-plugins/docker-sbom
scout: Docker Scout (Docker Inc.)
Version: v1.20.4
Path: /usr/local/lib/docker/cli-plugins/docker-scout

Server:
Containers: 15
Running: 15
Paused: 0
Stopped: 0
Images: 15
Server Version: 29.4.3
Storage Driver: overlayfs
driver-type: io.containerd.snapshotter.v1
Logging Driver: json-file
Cgroup Driver: cgroupfs
Cgroup Version: 2
Plugins:
Volume: local
Network: bridge host ipvlan macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
CDI spec directories:
/etc/cdi
/var/run/cdi
Discovered Devices:
cdi: docker.com/gpu=webgpu
Swarm: inactive
Runtimes: io.containerd.runc.v2 nvidia runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 77c84241c7cbdd9b4eca2591793e3d4f4317c590
runc version: v1.3.5-0-g488fc13e
init version: de40ad0
Security Options:
seccomp
Profile: builtin
cgroupns
Kernel Version: 6.6.114.1-microsoft-standard-WSL2
Operating System: Docker Desktop
OSType: linux
Architecture: x86_64
CPUs: 16
Total Memory: 31.34GiB
Name: docker-desktop
ID: 4000ea4f-9a2a-4dd3-96cb-fce34986b95b
Docker Root Dir: /var/lib/docker
Debug Mode: false
HTTP Proxy: http.docker.internal:3128
HTTPS Proxy: http.docker.internal:3128
No Proxy: hubproxy.docker.internal
Labels:
com.docker.desktop.address=unix:///var/run/docker-cli.sock
Experimental: false
Insecure Registries:
hubproxy.docker.internal:5555
::1/128
127.0.0.0/8
Live Restore Enabled: false
Firewall Backend: iptables

### Repro Steps

Have 3 PCs with identical builds - Docker Desktop on Windows 11 over WSL2 Debian 13 Trixie. All three have mirrored network mode. All three are running the same docker compose stack.

On one of the machines I cannot access the published ports from the Windows host. No special configurations or settings have been done to either. I have updated Windows, WSL Docker Desktop and the Debian WSL2 distros to the latest builds.

### Expected Behavior

http://127.0.0.1:16008 should be accessible both from inside WSL and from Windows.

### Actual Behavior

http://127.0.0.1:16008 is only accessible from inside WSL.

### Diagnostic Logs

I tried collecting logs after installing WPR:

First attempt:
```
PS C:\WINDOWS\system32> Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1 -LogProfile networking
networking.sh not found in the current directory. Downloading it from GitHub.

Log collection failed to start (exit code: -984087039), trying to reset it.
Couldn't start log collection (exitCode: -984087039)
```
...hung there. Could not exit using ctrl+c. Had to do from another PowerShell window:
```
pktmon stop
netsh wfp capture stop
wpr -cancel
```
Closed all WPR windows (the small main panel where the Start button is at, even though it wasn't recording + a big window where I had opened a previous result).

Second attempt:
```
PS C:\WINDOWS\system32> Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1 -LogProfile networking
networking.sh not found in the current directory. Downloading it from GitHub.

```
According to https://github.com/Microsoft/WSL/blob/master/CONTRIBUTING.md "The script will output when log collection starts.", but I got no further output, so I wasn't sure if it was recording. In WSL:
```
# ps aux | grep networking.sh
root 6921 0.0 0.0 6652 2448 pts/0 S+ 07:58 0:00 grep networking.sh
```
"Reproduce the problem, then press any key to stop the log collection.", but pressing any key on the keyboard didn't stop the process nor produce any output. Pressing ctrl+c triggered a "Stopping" message in the PowerShell status bar, but it's stuck there ever after.

Start by reproducing the published-port check at http://127.0.0.1:16008 from both Windows and WSL, comparing the affected PC with the two identical machines. Then inspect the mentioned collect-wsl-logs.ps1 and networking.sh workflow and use its networking profile while reproducing the failure. Done means the port is reachable from both environments and useful diagnostics identify the differing behavior.

Written by the indexing model from the issue text.