ARTIFACT // DIAGNOSE-CONTAINER-LLM.SH (SHELL)
Container-to-Host Local LLM Connectivity Diagnostic Script (diagnose-container-llm.sh)
Tests host bind address (127.0.0.1 vs 0.0.0.0), host.docker.internal DNS resolution, and bridge firewall rules.
[KEY VERIFIED TAKEAWAY / TL;DR]This reproducible configuration artifact "Container-to-Host Local LLM Connectivity Diagnostic Script" (diagnose-container-llm.sh, SHELL) is paired with Tinker AI Lab's hardware-verified guide "container-to-host-llm-networking". It exposes 2 customizable browser variables (HOST_PORT=11434, CONTAINER_NAME=tinker-open-webui) with loopback-first security defaults.
04 // DIAGNOSISAPI & Deployment Troubleshooting· Verified: 2026-10-23
Browse All 42 Artifacts →diagnose-container-llm.sh
View Paired Guide →Container-to-Host Local LLM Connectivity Diagnostic Script
Tests host bind address (127.0.0.1 vs 0.0.0.0), host.docker.internal DNS resolution, and bridge firewall rules.
Customizable Variables (Saved in Browser)
UTF-8 Encoded · Live Client-Side Compilation
#!/usr/bin/env bash # Tinker AI Troubleshooting — Container <-> Host Local Model Diagnostic (Guide #6) set -euo pipefail PORT="11434" CONTAINER="tinker-open-webui" echo "=== Step 1: Check Host Listening Address on Port $PORT ===" if lsof -nP -iTCP:"$PORT" -sTCP:LISTEN 2>/dev/null | grep -q "127.0.0.1:$PORT"; then echo "[FAIL] Host service is bound ONLY to 127.0.0.1:$PORT." echo " -> Fix: Set OLLAMA_HOST=0.0.0.0:$PORT on the host service and restart." else echo "[OK] Host service is not restricted to loopback only." fi echo "=== Step 2: Probe host.docker.internal from inside $CONTAINER ===" docker exec "$CONTAINER" sh -c "getent hosts host.docker.internal && wget -qO- --timeout=5 http://host.docker.internal:$PORT/api/version" \ && echo "[OK] Container reached host model API successfully!" \ || echo "[FAIL] Container cannot reach host.docker.internal:$PORT. Ensure extra_hosts: ['host.docker.internal:host-gateway'] is set."
PARAMETER SPECIFICATION // 参数化变量规范说明表
Customizable Parameter Reference for diagnose-container-llm.sh
This SHELL artifact exposes 2 template variables compiled client-side in your browser.
| Template Token | Parameter Description | Verified Default | Example Format |
|---|---|---|---|
{{HOST_PORT}} | Host LLM Port | 11434 | 11434 |
{{CONTAINER_NAME}} | Client Container Name | tinker-open-webui | tinker-open-webui |
PAIRED HARDWARE MANIFEST // 配套实测环境与边界记录
Verified Environment for "Container Cannot Connect to Host Model: Minimal Reproduction & Diagnostic Steps"
Tested Hardware & OS
Verified on Ubuntu 24.04 (Docker Engine 27.x + UFW) & macOS 15 (Docker Desktop 4.36)
Pinned Stack & Model Versions
Docker Engine 27.xOllama 0.5.7Open WebUI v0.5.10n8n 1.76.x
Offline Boundary (Local Loopback & Bridge Network Only)
Includes firewall rules to keep port 11434 isolated from external LAN/WAN while opening it to local containers.
Known Operational Limits & Failure Modes
- Using `network_mode: host` fixes Linux networking instantly, but is NOT supported on Docker Desktop for macOS or Windows.
- Binding `OLLAMA_HOST=0.0.0.0` on a cloud VPS without a firewall immediately exposes your model server to internet scanners.
DEPLOYMENT CHECKLIST // 配置落地核验步骤
3-Step Verification Checklist After Deploying diagnose-container-llm.sh
- Confirmed host port 11434 is listening on `*:11434` or `172.17.0.1:11434` (`lsof -nP -iTCP:11434 -sTCP:LISTEN`).
- Added `extra_hosts: ["host.docker.internal:host-gateway"]` to client containers.
- If using Linux UFW, allowed TCP port 11434 from `172.16.0.0/12` only.