桥接网络容器能否与主机网络容器建立Socket连接？

环境与需求 #

• Container A：处于自定义桥接网络中，作为TCP客户端，需在此网络内与其他容器通信。桥接网络网关为10.5.0.1，Container A固定IP为10.5.0.5
• Container B：以network_mode: host（主机网络模式）运行，作为TCP服务端，需连接主机的雷达设备

关键限制 #

• 无法将Container B迁移至桥接网络：其集成的第三方SDK存在MitM攻击防护机制，迁移后连接雷达会触发报错，厂商建议保留主机网络模式
• 无法将Container A切换至主机网络：团队顾虑容器内容暴露的安全风险

Container A配置与代码 #

Docker Compose配置 #

containerA:
    build: ./containerA
    restart: 'always'
    privileged: true
    environment:
        // ....
    labels:
        // ....
    volumes:
        // ....
    ports:
        // ....
      - 10299:10299
    networks:
      bridge:
        ipv4_address: 10.5.0.5

Socket连接代码 #

// HOST = "10.5.0.1"
    // PORT = 10299

    int sd;
    struct sockaddr_in server;
    struct in_addr ipv4addr;
    struct hostent *hp;

    printf("Creating socket\r\n");
    sd = socket(AF_INET, SOCK_STREAM, 0);
    server.sin_family = AF_INET;

    printf("Getting host by addr\r\n");
    
    inet_aton(HOST, &server.sin_addr);
    server.sin_family = AF_INET;
    server.sin_port = htons(PORT);

    printf("Connecting\r\n");
    connect(sd, (const sockaddr *)&server, sizeof(server)); 

Container B配置与代码 #

Docker Compose配置 #

containerB:
    build: ./containerB
    restart: 'always'
    privileged: true
    environment:
        // ....
    network_mode: 'host'
    ports:
      - 10299:10299 // 注：主机网络模式下该配置应该不需要

Socket监听代码 #

int opt = 1;
struct sockaddr_in addr;
socklen_t addrLen = sizeof(addr);

printf("Begin socket initialization\r\n");
int sockid = socket(AF_INET, SOCK_STREAM, 0);
if (sockid < 0)
{
    // Failed to open a socket
    printf("Failed to open socket; ret = %d\r\n", sockid);
    return (ret = sockid);
}

int ret2 = setsockopt(sockid, SOL_SOCKET, SO_REUSEADDR | SO_REUSEPORT, &opt, sizeof(opt));
if (ret2 < 0)
{
    // Failed to configure socket
    printf("Failed to configure socket; ret = %d\r\n", ret2);
    return (ret = ret2);
}

addr.sin_family = AF_INET;
addr.sin_addr.s_addr = INADDR_ANY;
//inet_aton(TCP_ADDRESS, &addr.sin_addr);
addr.sin_port = htons(targetPort); 

ret2 = bind(sockid, (struct sockaddr*)&addr, sizeof(addr));
if (ret2 < 0)
{
    printf("Failed to bind socket; ret = %d, errno = %d\r\n", ret2, errno);
    return (ret = ret2);
}

// Wait for socket connection to be established
printf("Listening on socket\r\n");
ret2 = listen(sockid, 3);
if (ret2 < 0)
{
    printf("Failed to listen for connection; ret = %d\r\n", ret2);
    return (ret = ret2);
}

printf("Accepting connection\r\n");
int newsockid = accept(sockid, (struct sockaddr*)&addr, &addrLen);
if (newsockid < 0)
{
    printf("Failed to accept socket connection; ret = %d\r\n", ret2);
    return (ret = newsockid);
}

已尝试操作 #

• Container A尝试连接10.5.0.1:10299（桥接网关地址）
• Container B配置为监听INADDR_ANY的10299端口
• 验证：Socket代码在同一容器内用localhost测试时可正常建立连接，仅跨桥接/主机网络模式时失败

请问：桥接网络容器能否与主机网络容器建立Socket连接？

内容的提问来源于stack exchange，提问作者Will A