An In-Depth Guide to Using Host Networking with Docker Compose

Docker host networking allows containers to share the host machine‘s network stack and interfaces. This guide dives deep on effectively leveraging host networking.

We‘ll cover performance, security, use cases, integration with orchestrators like Swarm, and more. Follow along to become a Docker host networking expert!

The Fundamentals

First, a quick refresher on host networking:

• Containers share the host IP, ports, sockets so can communicate over localhost
• Slight performance boost in some cases as traffic avoids virtual networks
• Sacrifices isolation since containers access the Docker engine and host directly

Enable host networking in Compose using:

network_mode: "host"

Now, let‘s analyze the performance and security tradeoffs in detail.

Host Networking Performance

Host networking can provide a minor performance boost over virtual bridge networks. But how much faster is it really?

Some key metrics on host vs bridge performance:

Metric	Host	Bridge	% Difference
Network Latency	21 μs	28 μs	33%
Request Throughput	18,248 req/sec	17, 603 req/sec	4%
Transfer Speed	3.8 Gbit/sec	3.5 Gbit/sec	8%

Source: Container Solutions Benchmark on Linux Host

As the benchmarks show, host networking has a significant latency reduction of 33% by avoiding virtual networks. This leads to a slight throughput and speed increase as well.

However, modern Docker hosts already operate at near native speeds. The performance gains are modest for most applications.

Still, squeezing out an extra 5-10% better network performance could benefit speed sensitive uses like gaming, streaming, and databases.

Now let‘s explore the security considerations of opening up containers directly on the host network.

Security Implications of Host Networking

Giving network access to the underlying Docker engine is risky from a security perspective. It grants containers privileged access normally reserved just for the host itself.

This breaks Docker‘s default defense-in-depth protections. If an attacker compromised a container, they could pivot deeper into the host system.

Some best practices around secure use of Docker host networking:

• Drop Linux capabilities with --cap-drop=all to limit access
• Apply seccomp, AppArmor, SELinux policies to least privilege container actions
• Use read-only volumes to prevent writing outside allowed directories
• Configure iptables to restrict network calls from containers to specific whitelisted ports
• Validate image integrity with hashes before deploying
• Scan images for known vulnerabilities regularly
• Restrict resource usage with constraints like CPU shares

In multi-tenant environments, isolate untrusted users from host networked containers entirely.

Apply the principle of least privilege to access. Only expose what is strictly required.

Now let‘s demonstrate host networking modes with some real-world examples and use cases.

Host Networking Usage Scenarios

We‘ll walk through using host networking with:

• A Node.js backend API service
• Python data science containers
• Legacy apps binding fixed bare metal ports

Imagine we are building an e-commerce site called ShopDotCom.

It needs a backend API for the front-end web app to fetch product and order data from.

Here is how we can deploy the API server on host networking:

1. API Server

backend:

  image: node:16-alpine

  command: node server.js

  ports:
    - "3000:3000"

  network_mode: host 

The API server binds port 3000 directly on the Docker host.

Front-ends can access it through the host IP rather than a separate container alias.

2. Data Science Containers

Now data scientists need Python notebooks for analytics:

datascience:

  image: jupyter/scipy-notebook

  volumes: 
    - ./notebooks:/home/jupyter/notebooks

  network_mode: host

  # Notebook server url
  command: start-notebook.sh --NotebookApp.token=‘‘

As the notebooks run on host networking, they can use localhost to directly reach the API container.

This avoids complex service discovery configuration.

3. Legacy Telnet Service

Perhaps we also run some old legacy apps that require fixed ports:

telnet:

  image: nicolaka/netshoot

  ports: 
    - "2323:23"

  network_mode: host

Host networking maps the legacy Telnet directly onto port 2323 host port.

In this example, host networking simplified networking requirements:

• API accessed directly through host IP and port
• Notebooks interact with API via localhost
• Legacy app binds fixed host port

Isolating these backend services fully would add complexity. Instead, we secured the host and applied resource limits to containers.

Now let‘s look at integrating containers on the host network into Swarm and Kubernetes.

Coordinating Host Networked Containers

Docker host networking also works with orchestrators like Swarm and Kubernetes.

However, the networking behaves slightly differently.

On Docker Swarm, containers remain constrained to individual host network interfaces.

A service on the host network on one node cannot reach a container on another node‘s host network. Swarm does not coordinate routing between host networks.

So you lose the ability to address containers directly on different nodes via virtual IPs.

On Kubernetes, host networking permits communication between different nodes‘ IP addresses directly.

Pods on the host network bypass the software-defined overlay network. This breaks some Kubernetes network policy features.

In general, if you need portability between nodes, using the CNI overlay driver is preferred to host networking on orchestrators.

Programming Languages and Host Networking

Host networking is convenient for application code wanting to communicate via localhost URLs and sockets.

For example, Python code could access a host-based API container through:

import requests 

response = requests.get(‘http://localhost/api/products‘)

While Node.js JavaScript could query a container-based MySQL database listening on the host subnet:

const db = require(‘mysql‘).createConnection({
    host: ‘127.0.0.1‘,
    user: ‘admin‘
    // ...
})

No special coding patterns are needed. Containers appear as normal processes.

Just be aware that namespaces isolate normal containers. Accessing localhost from an application won‘t reach containers by default without Docker aware libraries.

Potential Alternatives to Host Networking

We‘ve covered the performance boost, use cases, orchestration integration, and programming convenience of Docker host networking.

However, fully removing the network security boundary has downsides.

Some potential alternatives to evaluate:

• Overlay Driver – Maintains isolation and portability while permitting controlled inter-service communication.

• Macvlan Driver – Assign containers unique MAC addresses to participate directly on physical networks.

• Opening Ports – Rather than complete access, selectively expose individual ports to provide limited external connectivity.

• Sidecar Proxies – Route connections from app code through an intermediary proxy container to reach backend services.

• SSH Tunnels – Tunnel application traffic over an SSH connection into containers to avoid host exposure.

Consider if aspects of these approaches could address your requirements without needing full host permissions.

Key Takeaways and Best Practices

Let‘s recap the critical points around deploying containers on the Docker host network:

• Small performance boost by skipping virtual networks but focus is convenience
• Significantly reduces container isolation from host – apply additional safeguards
• Useful for inter-service communication over localhost
• Changes required when coordinating with Swarm and Kubernetes
• No special coding required from app code – containers appear as local processes
• Evaluate if alternatives like Macvlan sufficiently address needs before directly using host

In summary:

• Only use host network mode judiciously when benefits outweigh security downsides
• Lock down host interfaces and operating system access controls
• Isolate untrusted workloads fully – host network is privileged

This covers the key best practices!

Conclusion

We‘ve deep dived on directly attaching Docker containers to the underlying host machine‘s network stack.

Key takeaways:

• Performance gains are measurable but modest – main benefit is communication simplicity
• Restrict access and capabilities to mitigate risks as isolation drops
• Integrates with orchestrators like Swarm and Kubernetes but some limitations
• No special coding required – consume host networked container APIs and databases as localhost services

Evaluate if alternatives like overlay networks or Macvlan sufficiently address connectivity requirements before adopting host networking.

Used judiciously with safeguards, host networking unlocks convenient communication between containerized services and applications via the Docker host directly.

I hope this guide has provided an exhaustive analysis of Docker host networking and its implications! Let me know if you have any other questions.