Support lima environments

[gregnr]

A number of Docker Desktop alternatives use lima under the hood to manage Linux VM's:

• colima
• Rancher Desktop

Research how the networking works for these tools and find a way to get docker-mac-net-connect to work seamlessly with them.

Related:

• Help making it work with colima #16
• Can this tool help me connect port when docker run use --net="host" #8

[night0wl]

I did a bit of further research on this topic.

It seems that all Lima-based solutions work in a similar way. They create a bridge100 interface on the MacOS host, and a connected interface on the VM. The name varies, e.g. col0, rd1 etc. and the subnets they use also vary.

However, I discovered that it is not necessary to use them at all, and the utun3 <-> chip0 connection created by docker-mac-net-connect can be used instead. The only thing I needed to do to was to add an iptables rule:

sudo iptables -A FORWARD -s 10.33.33.1 -p tcp -j ACCEPT

I implemented this rule in the client/main.go code, but found it wasn’t working. When I dug a little deeper, I found that the reason was that the Alpine image which Colima / Rancher Desktop use, ships with a version of iptables which is using “legacy” instead of “nf_tables”. The docker image created by docker-mac-net-connect was installing a version of iptables that was using “nf_tables” and so the rules were not applying outside of the container.

To fix this, I updated the Dockerfile to include the following command

update-alternatives --set iptables /usr/sbin/iptables-legacy

I built the docker container locally, and tested everything with Docker Desktop, Colima, and Rancher Desktop. All three worked just fine with this update. I will add a PR to show the changes necessary.

EDIT: PR implementing the above: #27

[jaymecd]

Within my recent tests using rancher desktop = 1.16.0, colima = 0.8.1 and docker-mac-net-connect = v0.1.3 I haven't faced any issue, and there was no need to apply iptables rule mentioned by @night0wl above.

Both were tested using vz/qemu emulations, as well as rootless/privileged setup, with and without routable IP.

[reedjosh]

@jaymecd could you please detail what all you did that 'just worked'?

I cannot for the life of me get this to work without finagling all this.

[reedjosh]

I finally did just get the curl nginx command to work.

I am using the same version of colima 0.8.1, and no rancher setup at all.

v0.1.3 for mac-connect.

I did however have to add sudo iptables -A FORWARD -s 10.33.33.1 -p tcp -j ACCEPT to get it all to work and I had to link the colima docker socket.

sudo ln -sf /Users/< me >/.colima/default/docker.sock /var/run/docker.sock

[gregnr]

Hey everyone, good news! Colima is now officially supported as of v0.1.7. Also no need to manually symlink your /var/run/docker.sock - the server will now properly check your docker contexts and use your active context (which colima sets when it starts). All iptables rules are accounted for, even with the latest "Direct Access Filtering" rules added in Docker 28.0+. For more info please see #80.

You can upgrade to the latest by running:

brew upgrade chipmk/tap/docker-mac-net-connect
sudo brew services restart chipmk/tap/docker-mac-net-connect

If you encounter any issues, please let me know!