Can't access TrueNAS host from a docker container running in a jail

[pheitman]

I am trying to get homepage running on docker within my docker jail I have created on TrueNAS scale. I have lots of apps that work fine but this is the first time I want to access the TrueNAS URL from within a container. The TrueNAS IP address is unreachable from within the container. I have tried the default container network, host and bridge to no avail. I have also tried the host.docker.internal approach. Any ideas for what I need to do so that the TrueNAS port on the host is accessible?

[Jip-Hop]

We'd be able to help you better if you post more info such as your config. Also read this: https://github.com/Jip-Hop/jailmaker#filing-issues-and-community-support

[Jip-Hop]

That's a limitation of using macvlan networking. It's documented in the networking docs in the jailmaker repo. Please use bridge networking if you need to communicate with the TrueNAS host.

[Jip-Hop]

P.S. If you only need CAP_IPC_LOCK then there's no need to pass all capabilities.

[pheitman]

I tried just passing in CAP_IPC_LOCK and all of my containers stopped working. I must have done something wrong, but passing in all capabilities 'just worked' (with any downsides hidden from me).

I'll look in to using bridge networking ASAP. Thanks for the help!

[Jip-Hop]

Restricting capabilities to only the required ones helps with isolation and therefore increases security. That would be the benefit of not passing all capabilities.

[pheitman]

I was able to set up bridge networking (following the youtube video and the documentation on this github site). I was pleased that I was able to set it up with the static IP address that my DHCP server had assigned to the TrueNAS instance. That meant fewer headaches because some things (like my Windows hosts file) already had that address configured. After setting up the bridge I was able to configure the service widgets in Homepage that accessed the containers via ports on the docker jail. I will look in to only passing in the capabilities I need next. Thanks again for the help.