DIAGNOSTIC TREE // CONTAINER-HOST-NETWORK (4 ROOT CAUSES)

Container Cannot Reach Host Local Model (Ollama / vLLM)

Diagnose loopback binding (127.0.0.1 vs 0.0.0.0), host.docker.internal DNS on Linux, and bridge firewall drops.

[KEY VERIFIED TAKEAWAY / TL;DR]This diagnostic decision tree for "Container Cannot Reach Host Local Model (Ollama / vLLM)" provides 7 interactive nodes and 4 hardware-verified root-cause fixes (Fix: Bind Host Ollama to 0.0.0.0 (or Docker Bridge IP); Fix: Replace localhost with host.docker.internal; Fix: Map host-gateway in Linux Docker Compose; Fix: Allow Docker Bridge Subnet Through Host Firewall (UFW / firewalld)), paired with our reproducible guide "container-to-host-llm-networking".

Step 1: Check Host Listening Interface

Run the command below on your host machine. Is port 11434 bound to 127.0.0.1 or *:11434 (0.0.0.0)?

Diagnostic Probe Command

lsof -nP -iTCP:11434 -sTCP:LISTEN || ss -tlnp | grep 11434

If it shows 127.0.0.1:11434, requests from Docker bridge networks will be immediately refused.

Select what your environment outputs:

DIAGNOSTIC PROBE SEQUENCE // 完整分步探测命令与症状分支

All 3 Terminal Diagnostic Probes in "Container Cannot Reach Host Local Model (Ollama / vLLM)"

Complete static reference of every read-only probe command, baseline hint, and branch transition in this decision tree.

Step 1: Check Host Listening Interfacestep-host-bind

Run the command below on your host machine. Is port 11434 bound to 127.0.0.1 or *:11434 (0.0.0.0)?

lsof -nP -iTCP:11434 -sTCP:LISTEN || ss -tlnp | grep 11434

If it shows 127.0.0.1:11434, requests from Docker bridge networks will be immediately refused.

Symptom Branches:

• It shows 127.0.0.1:11434 (Loopback only)→ sol-bind-all-interfaces
• It shows *:11434 or 0.0.0.0:11434→ step-container-url

Step 2: Verify Target URL Used Inside the Containerstep-container-url

What URL is your container (Open WebUI / n8n / Dify) using to call the host model?

docker exec -it tinker-open-webui sh -c "env | grep -E 'OLLAMA|API'"

Symptom Branches:

• http://localhost:11434 or http://127.0.0.1:11434→ sol-container-localhost-trap
• http://host.docker.internal:11434 (Still failing)→ step-linux-gateway-or-firewall

Step 3: Test DNS Resolution vs Firewall Drop Inside Containerstep-linux-gateway-or-firewall

Execute this probe inside the container. Does it fail with "bad address" (DNS) or "Connection timed out" (Firewall)?

docker exec tinker-open-webui sh -c "getent hosts host.docker.internal && wget -qO- --timeout=5 http://host.docker.internal:11434/api/version"

Symptom Branches:

• getent returns nothing / "bad address" on Linux Docker→ sol-linux-extra-hosts
• DNS resolves to 172.17.0.1, but connection times out→ sol-ufw-firewall-bridge

ALL VERIFIED FIXES IN THIS TREE // 本树涵盖的全部根因与修复方案一览

4 Verified Root Causes, Fix Configs & Commands in "Container Cannot Reach Host Local Model (Ollama / vLLM)"

Fix: Bind Host Ollama to 0.0.0.0 (or Docker Bridge IP)

sol-bind-all-interfaces

By default, Ollama binds strictly to 127.0.0.1:11434. Traffic arriving from a Docker bridge interface (172.17.0.x) is rejected by the OS TCP stack.

On macOS: set OLLAMA_HOST via launchctl and restart the Ollama desktop app.
On Linux systemd: add Environment="OLLAMA_HOST=0.0.0.0:11434" via systemctl edit ollama.service.
Security check: ensure your host firewall blocks port 11434 on public LAN/WAN interfaces.

# macOS (launchctl)
launchctl setenv OLLAMA_HOST "0.0.0.0:11434"
# Then Quit and Reopen Ollama.app

# Linux (systemd override)
sudo mkdir -p /etc/systemd/system/ollama.service.d
printf "[Service]\nEnvironment=\"OLLAMA_HOST=0.0.0.0:11434\"\n" | sudo tee /etc/systemd/system/ollama.service.d/override.conf
sudo systemctl daemon-reload && sudo systemctl restart ollama

[BOUNDARY]Binding to 0.0.0.0 exposes the unauthenticated Ollama API to your local network unless filtered by firewall.

Verify: lsof -nP -iTCP:11434 -sTCP:LISTEN

Fix: Replace localhost with host.docker.internal

sol-container-localhost-trap

Inside a container network namespace, localhost/127.0.0.1 refers to the container itself, not the physical host running your model.

Update OLLAMA_BASE_URL or your HTTP node URL to http://host.docker.internal:11434.
Ensure extra_hosts: ["host.docker.internal:host-gateway"] is present in docker-compose.yml.

services:
  open-webui:
    environment:
      - OLLAMA_BASE_URL=http://host.docker.internal:11434
    extra_hosts:
      - "host.docker.internal:host-gateway"

[BOUNDARY]Works identically across Docker Desktop (Mac/Windows) and Docker Engine 20.10+ on Linux.

Verify: docker exec tinker-open-webui wget -qO- http://host.docker.internal:11434/api/version

Fix: Map host-gateway in Linux Docker Compose

sol-linux-extra-hosts

Unlike Docker Desktop on Mac/Windows, native Linux Docker Engine does not inject host.docker.internal into /etc/hosts unless explicitly requested.

Add extra_hosts: ["host.docker.internal:host-gateway"] to your service definition in docker-compose.yml.
Recreate the container with docker compose up -d --force-recreate.

docker run -d \
  --name tinker-open-webui \
  --add-host=host.docker.internal:host-gateway \
  -e OLLAMA_BASE_URL=http://host.docker.internal:11434 \
  -p 3000:8080 \
  ghcr.io/open-webui/open-webui:v0.5.10

[BOUNDARY]Requires Docker Engine 20.10 or newer.

Verify: docker exec tinker-open-webui getent hosts host.docker.internal

Fix: Allow Docker Bridge Subnet Through Host Firewall (UFW / firewalld)

sol-ufw-firewall-bridge

Linux UFW or iptables drops packets originating from the docker0 / br-* subnet (172.16.0.0/12) destined for host port 11434.

Grant access strictly from the private Docker bridge CIDR (172.16.0.0/12) to port 11434.
Reload UFW and test from inside the container again.

sudo ufw allow from 172.16.0.0/12 to any port 11434 proto tcp comment "Allow Docker containers to local Ollama"
sudo ufw reload

[BOUNDARY]Restricting the rule to 172.16.0.0/12 prevents external LAN hosts from accessing port 11434.

Verify: docker exec tinker-open-webui wget -qO- --timeout=5 http://host.docker.internal:11434/api/version

PAIRED REPRODUCIBLE GUIDE // 配套实测指南与硬件环境基线

Container Cannot Connect to Host Model: Minimal Reproduction & Diagnostic Steps

Solve the #1 self-hosted AI failure (`ECONNREFUSED` / `ETIMEDOUT` calling port 11434 from Open WebUI, n8n, or Dify) in three deterministic verification commands.

Paired Config Artifact →Read Full Verified Guide →

TESTED HARDWARE & OS

Verified on Ubuntu 24.04 (Docker Engine 27.x + UFW) & macOS 15 (Docker Desktop 4.36)

PINNED STACK VERSIONS

Docker Engine 27.x · Ollama 0.5.7 · Open WebUI v0.5.10 · n8n 1.76.x

VERIFIED (2026-10-23)

Local Loopback & Bridge Network Only — Includes firewall rules to keep port 11434 isolated from external LAN/WAN while opening it to local containers.