Mac下host网络模式docker-compose部署nginx无法暴露8008端口问题求助

network_mode: "host" 仅原生支持Linux宿主机的Docker环境。Docker Desktop for macOS运行在轻量虚拟化层内，host模式只会将容器端口绑定到虚拟化层的网络命名空间，不会透传到macOS宿主机，因此宿主机无法监听到8008端口。

1. 修改docker-compose.yaml配置 #

删除network_mode: "host"配置，添加端口映射规则：

services:
    hub-nginx:  # Running on port 8008.
        restart: always
        image: nginx:alpine
        ports:
          - "8008:8008"
        volumes:
            - ./path/nginx.conf:/etc/nginx/conf.d/default.conf:ro,Z
            - ./path/hub-service.include:/etc/nginx/include.d/hub-service.include:Z
            - ./path/hub-headers.include:/etc/nginx/include.d/hub-headers.include:Z
            - ./path/security-headers.include:/etc/nginx/include.d/security-headers.include:Z
            - ./path/certs/:/etc/nginx/certs/:Z
    ...

2. 修改nginx.conf反向代理地址 #

将proxy_pass的目标地址替换为Docker Desktop为macOS/Windows内置的宿主机域名host.docker.internal：

server {
    listen       8008 default_server;
    listen       [::]:8008 default_server;
    server_name  _;

    include /etc/nginx/include.d/security-headers.include;

    location /hub/ui { rewrite /hub/ui / permanent; }
    location /hub/ui/ { rewrite /hub/ui/ / permanent; }
    location /ui { rewrite /ui / permanent; }
    location /ui/ { rewrite /ui/ / permanent; }
    location / {
        proxy_pass http://host.docker.internal:3000;
        proxy_set_header Host $http_host;
        proxy_set_header X-Original-URI $request_uri;

        include /etc/nginx/include.d/hub-service.include;
        include /etc/nginx/include.d/security-headers.include;
    }
}

（可选）跨平台兼容配置 #

如果需要一套配置同时兼容Linux和macOS环境，可在docker-compose.yaml中添加extra_hosts配置，Docker 20.10+版本会自动适配不同平台的宿主机地址解析：

services:
    hub-nginx:
        # 其余原有配置保持不变
        extra_hosts:
          - "host.docker.internal:host-gateway"

验证步骤 #

1. 重启容器使配置生效：docker-compose up -d --force-recreate hub-nginx
2. 测试容器到宿主机服务的连通性：docker-compose exec hub-nginx wget -qO- http://host.docker.internal:3000，返回正常内容说明连通无问题
3. 访问宿主机http://localhost:8008验证反向代理功能

注意事项 #

宿主机运行的Node服务需要绑定0.0.0.0:3000而非仅127.0.0.1:3000，否则来自Docker容器的请求会被宿主机网络拦截。

内容的提问来源于stack exchange，提问作者Aleksandr