Using socat to enable LAN access to Docker ports on a Mac

This is a guide on how to use socat on MacOS to enable local LAN access to your container ports on Docker. Previously I’d used Docker Mac Net Connect but at the time of writing this did not work with the most recent version of Docker Desktop 4.3.90.

Why Docker on macOS Restricts Certain Networking Configurations

On Linux, Docker containers typically run on a bridge network that is directly accessible from the host machine. When you publish a port (using -p or — publish) in Linux Docker, Docker modifies iptables rules, allowing inbound traffic to the container’s port.

On macOS (and Windows), Docker runs inside a lightweight virtual machine (VM). This means:

• The host (your macOS environment) cannot directly reach into the Docker VM network without routing through the VM’s networking stack.

• Docker Desktop’s port mappings like -p 8080:80 work if you access your container from localhost but Docker itself doesn’t map the ports to the interface used on your.

What is socat?

socat (short for socket CAT) is a command-line utility designed to relay or forward data between two endpoints. These endpoints can be:

• TCP sockets

• UDP sockets

• Unix domain sockets

• Files

• Serial lines

• Other socat instances

In the context of Docker on macOS, we leverage socat to forward traffic from a port on your macOS host to a port inside the Docker VM or container. Essentially, socat sets up a listening port on the Mac, and when a connection arrives, it relays that data over to the container’s IP/port.

Socat Installation

1. Install with Homebrew (if you don’t already have it):

brew install socat

2. Ensure socat is in your PATH by verifying:

which socat

You should see something /opt/homebrew/bin/socat for Apple Silicon.

Basic Command to Forward a Port

Suppose you have a Docker container that is only reachable on localhost:3000 like Open Web-UI. You can expose it on your Mac’s port 8080 by using:

socat TCP-LISTEN:8080,fork TCP:127.0.0.1:3000

Let’s break down the parameters:

• TCP-LISTEN:8080:

• Opens a listening TCP socket on port 8080 on your macOS host.

• fork:

• Tells socat to handle multiple connections by forking a new process for each incoming connection.

• TCP:127.0.0.1:3000:

• This is the destination — the Dockerized service that is bound to localhost:3000 from the perspective of your host system or via port mapping.

Why not listen on port 3000 (as that’s the default port used by Open WebIU ? This port is already in use by Docker on your localhost, so you just need to pick a free port.

Running Socat as a macOS Service (Launch Daemon)

Running the socat command manually is fine for testing, but you may want it to run persistently and automatically on system boot. On macOS, you typically use launchd services (or launch daemons) to manage long-running processes.

Below is an example of how to set up a launch daemon for socat. Note that daemons run as root, so you need administrative privileges.

Create a Launch Daemon Configuration File

1. Create the file /Library/LaunchDaemons/com.docker.socat.plist (you can choose a different path/name, but /Library/LaunchDaemons/ is a common place for system-wide services).

sudo nano /Library/LaunchDaemons/com.docker.socat.plist 

2. Add the following XML (replace the command arguments with whichever port forwarding scheme you need):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" 
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>com.docker.socat</string>

    <key>ProgramArguments</key>
    <array>
      <string>/opt/homebrew/bin/socat</string>
      <!-- Listen on port 8080 and forward to local Docker port 3000 -->
      <string>TCP-LISTEN:8080,fork</string>
      <string>TCP:127.0.0.1:3000</string>
    </array>
    <!-- Run as root (needed if binding to privileged ports <1024) -->
    <key>RunAtLoad</key>
    <true/>
    <!-- KeepAlive ensures the daemon is automatically relaunched if it terminates -->
    <key>KeepAlive</key>
    <true/>
  </dict>
</plist>

Adjust the path to socat depending on where Homebrew installed it. On Apple Silicon the default is /opt/homebrew/bin/socat.

Load and Start the Service

Open Terminal and run:

sudo launchctl load /Library/LaunchDaemons/com.docker.socat.plist
sudo launchctl start com.docker.socat

This does two things:

1. load: Instructs launchd to read your plist and register the service.

2. start: Tells launchd to start the process immediately.

Verify the Service

Check if the service is running:

sudo launchctl list | grep com.docker.socat

If it’s working, you should see a line containing com.docker.socat. You can also test by using curl http://localhost (if you’ve set up the service to forward port 8080 → 3000).

Unloading or Stopping the Service

To remove or stop the service:

sudo launchctl stop com.docker.socat
sudo launchctl unload /Library/LaunchDaemons/com.docker.socat.plist

Then remove the .plist file if you no longer need it.

Tips, Tricks, and Best Practices

1. Privilege and Ports

Ports below 1024 require elevated privileges. That’s why sudo or a launch daemon might be necessary if you’re binding to something like port 80 or 443.

2. Multiple Services

You can run multiple instances or define multiple listeners. For example:

socat TCP-LISTEN:8080,fork TCP:127.0.0.1:3000 & 
socat TCP-LISTEN:443,fork TCP:127.0.0.1:8443 &

Just ensure the ports you choose are free.

3. Securing Traffic

For production, you might want to add TLS/SSL termination or additional security. socat supports SSL endpoints (using openssl parameters), so you can encrypt traffic if necessary.

4. Log and Debug

If you want socat to produce logs or more debugging information, add -d -d -v to your command:

socat -d -d -v TCP-LISTEN:8080,fork TCP:127.0.0.1:3000

This will help you see connections as they come in.

6. Conclusion

When running Docker on macOS, direct host-to-container networking is different compared to Linux due to the virtualization layer Docker Desktop uses. By installing socat and creating a simple launch daemon, you can automatically forward ports on your macOS host to your Docker container, giving you total control over how traffic flows without depending solely on Docker Desktop’s default mappings.