[{"data":1,"prerenderedAt":909},["ShallowReactive",2],{"content-index":3,"guide-en-self-hosting-docker-desktop-mac-client-ip":80,"guides-navigation-en":814},{"en":4,"de":54,"es":67},{"paths":5,"docs":29},[6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28],"\u002Fdocs\u002Fgetting-started","\u002Fdocs\u002Flinux","\u002Fdocs\u002Fmacos","\u002Fdocs\u002Fwindows","\u002Fdocs\u002Fdocker","\u002Fdocs\u002Fcreate-api-key","\u002Fguides\u002Ffind-your-public-ip-address\u002Ffind-your-ip-address-on-linux","\u002Fguides\u002Ffind-your-public-ip-address\u002Ffind-your-ip-address-on-mac","\u002Fguides\u002Ffind-your-public-ip-address\u002Ffind-your-ip-address-on-windows","\u002Fguides\u002Ffind-your-public-ip-address","\u002Fguides\u002Fself-hosting\u002Fdocker-desktop-mac-client-ip","\u002Fguides\u002Fself-hosting\u002Fexpose-docker-containers-to-the-internet","\u002Fguides\u002Fself-hosting\u002Fexpose-home-server-to-internet","\u002Fguides\u002Fself-hosting\u002Fgetpublicip-vs-cloudflare-tunnel-vs-tailscale","\u002Fguides\u002Fself-hosting\u002Fmac-mini-home-server","\u002Fguides\u002Fself-hosting\u002Fport-forwarding-not-working","\u002Fguides\u002Fself-hosting\u002Fself-hosting-behind-carrier-grade-nat-cgnat","\u002Fguides\u002Fself-hosting\u002Fwireguard-simple-watchdog-script","\u002Fguides\u002Fstatic-public-ip-address\u002Fhow-to-get-a-public-ip-address","\u002Fguides\u002Fstatic-public-ip-address\u002Fhow-to-get-a-static-ip-address","\u002Fguides\u002Fstatic-public-ip-address","\u002Fguides\u002Fuse-cases\u002Fhome-server","\u002Fguides\u002Fuse-cases\u002Foffice-server",[30,34,38,42,46,50],{"path":6,"title":31,"icon":32,"stem":33},"Getting Started","mdi-file-document-outline","docs\u002F1.getting-started",{"path":7,"title":35,"icon":36,"stem":37},"Linux","mdi-linux","docs\u002F2.linux",{"path":8,"title":39,"icon":40,"stem":41},"macOS","mdi-apple","docs\u002F3.macos",{"path":9,"title":43,"icon":44,"stem":45},"Windows","mdi-microsoft-windows","docs\u002F3.windows",{"path":10,"title":47,"icon":48,"stem":49},"Docker","mdi-docker","docs\u002F4.docker",{"path":11,"title":51,"icon":52,"stem":53},"Create API Key","mdi-key","docs\u002F5.create-api-key",{"paths":55,"docs":58},[6,7,8,9,10,11,12,14,15,56,17,18,57,19,21,22,24,25,26,27,28],"\u002Fguides\u002Fself-hosting\u002Fdyndns-hinter-cgnat","\u002Fguides\u002Fself-hosting\u002Ffritzbox-portfreigabe-ds-lite",[59,61,62,63,64,65],{"path":6,"title":60,"icon":32,"stem":33},"Erste Schritte",{"path":7,"title":35,"icon":36,"stem":37},{"path":8,"title":39,"icon":40,"stem":41},{"path":9,"title":43,"icon":44,"stem":45},{"path":10,"title":47,"icon":48,"stem":49},{"path":11,"title":66,"icon":52,"stem":53},"API-Schlüssel erstellen",{"paths":68,"docs":71},[6,7,8,9,10,11,12,14,15,69,70,17,18,19,21,22,24,25,26,27,28],"\u002Fguides\u002Fself-hosting\u002Fcomo-saber-si-tengo-cgnat","\u002Fguides\u002Fself-hosting\u002Fddns-detras-de-cgnat",[72,74,75,76,77,78],{"path":6,"title":73,"icon":32,"stem":33},"Primeros pasos",{"path":7,"title":35,"icon":36,"stem":37},{"path":8,"title":39,"icon":40,"stem":41},{"path":9,"title":43,"icon":44,"stem":45},{"path":10,"title":47,"icon":48,"stem":49},{"path":11,"title":79,"icon":52,"stem":53},"Crear clave API",{"id":81,"title":82,"body":83,"createdAt":793,"description":794,"extension":795,"faq":796,"meta":807,"navigation":808,"path":16,"seo":811,"stem":812,"updatedAt":793,"__hash__":813},"content_en\u002Fguides\u002Fself-hosting\u002Fdocker-desktop-mac-client-ip.md","Docker on Mac Sees 192.168.65.1? Why, and How to Fix It",{"type":84,"value":85,"toc":777},"minimark",[86,91,109,112,171,204,312,342,381,585,667,749,753,773],[87,88,90],"h1",{"id":89},"why-docker-on-a-mac-sees-192168651-instead-of-the-clients-ip","Why Docker on a Mac Sees 192.168.65.1 Instead of the Client's IP",[92,93,96],"guide-quick-answer",{"cta-title":94,"cta-text":95},"Self-hosting behind CGNAT?","Get a dedicated public IPv4 and IPv6 that stays yours and accepts inbound connections.",[97,98,99,103,104,108],"p",{},[100,101,102],"strong",{},"Docker Desktop relays every published port."," A Docker process on your Mac accepts the visitor's connection, then opens a new one into Docker's Linux virtual machine. The container only sees that second connection, which comes from ",[105,106,107],"code",{},"192.168.65.1",". No setting changes this. Run the service directly on macOS, or put a proxy on the Mac that passes the address in a header.",[97,110,111],{},"We found this while testing self-hosting on a Mac mini, and confirmed it on 3 November 2026 with Docker Desktop 4.96.3 on macOS 27.0.1, using Docker's default network settings.",[113,114,124,129],"v-sheet",{"className":115,"rounded":122,"max-width":123},[116,117,118,119,120,121],"mx-auto","pa-lg-4","pa-2","mt-2","mb-4","ma-0","","1200",[125,126,128],"h2",{"id":127},"key-takeaways","Key takeaways",[130,131,132,143,146,157,164],"ul",{},[133,134,135,136,139,140,142],"li",{},"On Docker Desktop for Mac, a container behind a published port (",[105,137,138],{},"-p 80:80",") sees every visitor as ",[105,141,107],{},".",[133,144,145],{},"The visitor's real address reaches your Mac. Docker's relay drops it before the container.",[133,147,148,149,156],{},"Docker has an open request for this, ",[150,151,155],"a",{"href":152,"rel":153},"https:\u002F\u002Fgithub.com\u002Fdocker\u002Froadmap\u002Fissues\u002F157",[154],"nofollow","docker\u002Froadmap#157",", and OrbStack has the same limitation.",[133,158,159,160,163],{},"What works: run the service on macOS itself, or put a reverse proxy on the Mac that sends ",[105,161,162],{},"X-Forwarded-For"," or the PROXY protocol.",[133,165,166,167,170],{},"Publishing as ",[105,168,169],{},"\"0.0.0.0:80:80\""," also makes Docker Desktop accept IPv4 only. Leave the address out to get IPv6 too.",[113,172,174,178,185,191,201],{"className":173,"rounded":122,"max-width":123},[116,117,118,119,120,121],[125,175,177],{"id":176},"why-the-container-sees-192168651","Why the container sees 192.168.65.1",[97,179,180,181,184],{},"Docker Desktop runs your containers inside a Linux virtual machine, because macOS can't run Linux containers itself. When you publish a port, Docker's own process on the Mac, ",[105,182,183],{},"com.docker.backend",", listens on it. Each visitor's connection ends at that process. It then opens a second connection into the virtual machine and copies the data across.",[97,186,187,188,190],{},"The container sees the source of the second connection: Docker's side of its internal network, ",[105,189,107],{}," with the default settings. Your router and your LAN aren't involved.",[97,192,193],{},[194,195],"img",{"alt":196,"className":197,"src":200},"Diagram comparing Docker Desktop on a Mac, where Docker's process accepts the visitor's connection and opens a second one so the container sees 192.168.65.1, with Docker on a Linux host, where a firewall rule forwards the visitor's own connection and the container sees the real address",[198,199],"w-100","my-4","\u002Fimages\u002Fguides\u002Fdocker_desktop_mac_client_ip.svg",[97,202,203],{},"On a Linux host, Docker forwards a published port with a firewall rule (DNAT) that rewrites only the destination. The visitor's own connection reaches the container, and its source address comes with it.",[113,205,207,211,214,254,260,263,290,298],{"className":206,"rounded":122,"max-width":123},[116,117,118,119,120,121],[125,208,210],{"id":209},"what-we-saw-on-our-mac","What we saw on our Mac",[97,212,213],{},"We ran nginx in Docker Desktop with port 80 published, and connected to it from a server on the internet. The Mac and the container recorded the same request differently:",[215,216,217,230],"table",{},[218,219,220],"thead",{},[221,222,223,227],"tr",{},[224,225,226],"th",{},"Where we looked",[224,228,229],{},"Address it showed for the visitor",[231,232,233,245],"tbody",{},[221,234,235,242],{},[236,237,238,239],"td",{},"The Mac: ",[105,240,241],{},"lsof -nP -iTCP:80",[236,243,244],{},"the visitor's real address",[221,246,247,250],{},[236,248,249],{},"nginx's access log in the container",[236,251,252],{},[105,253,107],{},[97,255,256,257,259],{},"A second test on port 8080 got the same result over IPv6: nginx logged ",[105,258,107],{}," for an IPv6 visitor too.",[97,261,262],{},"You can check your own setup the same way. While a connection is open, run this on the Mac:",[264,265,269],"pre",{"className":266,"code":267,"language":268,"meta":122,"style":122},"language-shell shiki shiki-themes monokai","lsof -nP -iTCP:80 -sTCP:ESTABLISHED\n","shell",[105,270,271],{"__ignoreMap":122},[272,273,276,280,284,287],"span",{"class":274,"line":275},"line",1,[272,277,279],{"class":278},"sHkqI","lsof",[272,281,283],{"class":282},"s7s5_"," -nP",[272,285,286],{"class":282}," -iTCP:80",[272,288,289],{"class":282}," -sTCP:ESTABLISHED\n",[264,291,296],{"className":292,"code":294,"language":295},[293],"language-text","COMMAND     PID USER   FD   TYPE  DEVICE SIZE\u002FOFF NODE NAME\ncom.docke   787 you   131u  IPv4  0x...       0t0  TCP 192.168.1.20:80->203.0.113.9:52144 (ESTABLISHED)\n","text",[105,297,294],{"__ignoreMap":122},[97,299,300,301,304,305,308,309,311],{},"The address after ",[105,302,303],{},"->"," is the visitor. Then look at your container's log (",[105,306,307],{},"docker logs \u003Ccontainer>","): if every line starts with ",[105,310,107],{},", you're seeing the relay.",[113,313,315,319,322,339],{"className":314,"rounded":122,"max-width":123},[116,117,118,119,120,121],[125,316,318],{"id":317},"what-it-breaks","What it breaks",[97,320,321],{},"Anything inside the container that acts on the visitor's address sees one visitor:",[130,323,324,327,333,336],{},[133,325,326],{},"access logs and analytics;",[133,328,329,330,332],{},"rate limiting, fail2ban and CrowdSec, which end up blocking ",[105,331,107],{},", and with it everyone;",[133,334,335],{},"allowlists and geo-blocking;",[133,337,338],{},"apps that record a login's IP address, such as Nextcloud and Vaultwarden.",[97,340,341],{},"Filtering that happens before traffic reaches your Mac, such as a firewall rule on your router, still works, because it never depends on the container.",[113,343,345,349,352],{"className":344,"rounded":122,"max-width":123},[116,117,118,119,120,121],[125,346,348],{"id":347},"why-no-setting-fixes-it","Why no setting fixes it",[97,350,351],{},"The relay is how Docker Desktop reaches its virtual machine, so there's nothing to switch off.",[130,353,354,360,369,378],{},[133,355,356,357,142],{},"Docker's request to pass the original address to containers has been open since October 2020 as ",[150,358,155],{"href":152,"rel":359},[154],[133,361,362,363,368],{},"Docker's documentation says ",[150,364,367],{"href":365,"rel":366},"https:\u002F\u002Fdocs.docker.com\u002Fengine\u002Fnetwork\u002Fdrivers\u002Fhost\u002F",[154],"host networking"," in Docker Desktop 4.34 and later \"works on layer 4\". It doesn't say the client's address is kept, and we haven't tested it.",[133,370,371,372,377],{},"OrbStack has the same limitation, open as ",[150,373,376],{"href":374,"rel":375},"https:\u002F\u002Fgithub.com\u002Forbstack\u002Forbstack\u002Fissues\u002F710",[154],"orbstack#710",". Its maintainer wrote in July 2025: \"This is not expected behavior, but there are currently some internal limitations that make this hard to fix.\"",[133,379,380],{},"We haven't tested Colima or Rancher Desktop.",[113,382,384,388,391,396,399,402,406,412,547,554,558,575,578,582],{"className":383,"rounded":122,"max-width":123},[116,117,118,119,120,121],[125,385,387],{"id":386},"fixes-that-work","Fixes that work",[97,389,390],{},"We tested the problem and the IPv6 behaviour on our own Mac. The proxy settings below are the standard ones from each project's documentation.",[392,393,395],"h3",{"id":394},"_1-run-the-service-on-macos-itself","1. Run the service on macOS itself",[97,397,398],{},"A program running directly on macOS, installed from Homebrew or as a native app, accepts the visitor's connection itself and sees the real address, over IPv4 and IPv6, for TCP and UDP. Plex, Jellyfin, nginx, Caddy and most databases have native macOS builds.",[97,400,401],{},"It also covers UDP, such as game servers and VoIP, which the proxy fixes below don't.",[392,403,405],{"id":404},"_2-a-reverse-proxy-on-the-mac-for-websites","2. A reverse proxy on the Mac, for websites",[97,407,408,409,411],{},"Run a reverse proxy directly on macOS, in front of the container. It accepts the visitor's connection, so it sees the real address, and passes it on in the ",[105,410,162],{}," header.",[413,414,415,473,521],"ol",{},[133,416,417,418],{},"Publish the container's port on the loopback address only, so nothing can reach it without going through the proxy and fake the header:",[264,419,423],{"className":420,"code":421,"language":422,"meta":122,"style":122},"language-yaml shiki shiki-themes monokai","services:\n  web:\n    image: nginx:stable-alpine\n    ports:\n      - \"127.0.0.1:8080:80\"\n","yaml",[105,424,425,435,443,456,464],{"__ignoreMap":122},[272,426,427,431],{"class":274,"line":275},[272,428,430],{"class":429},"s8I7P","services",[272,432,434],{"class":433},"sCdxs",":\n",[272,436,438,441],{"class":274,"line":437},2,[272,439,440],{"class":429},"  web",[272,442,434],{"class":433},[272,444,446,449,452],{"class":274,"line":445},3,[272,447,448],{"class":429},"    image",[272,450,451],{"class":433},": ",[272,453,455],{"class":454},"s_Ekj","nginx:stable-alpine\n",[272,457,459,462],{"class":274,"line":458},4,[272,460,461],{"class":429},"    ports",[272,463,434],{"class":433},[272,465,467,470],{"class":274,"line":466},5,[272,468,469],{"class":433},"      - ",[272,471,472],{"class":454},"\"127.0.0.1:8080:80\"\n",[133,474,475,476,481,482,484,485],{},"Run the proxy on the Mac. With ",[150,477,480],{"href":478,"rel":479},"https:\u002F\u002Fcaddyserver.com\u002Fdocs\u002Fcommand-line#caddy-reverse-proxy",[154],"Caddy",", which adds ",[105,483,162],{}," by default:",[264,486,488],{"className":266,"code":487,"language":268,"meta":122,"style":122},"brew install caddy\ncaddy reverse-proxy --from :80 --to 127.0.0.1:8080\n",[105,489,490,501],{"__ignoreMap":122},[272,491,492,495,498],{"class":274,"line":275},[272,493,494],{"class":278},"brew",[272,496,497],{"class":454}," install",[272,499,500],{"class":454}," caddy\n",[272,502,503,506,509,512,515,518],{"class":274,"line":437},[272,504,505],{"class":278},"caddy",[272,507,508],{"class":454}," reverse-proxy",[272,510,511],{"class":282}," --from",[272,513,514],{"class":454}," :80",[272,516,517],{"class":282}," --to",[272,519,520],{"class":454}," 127.0.0.1:8080\n",[133,522,523,524,529,530],{},"Tell the app in the container to trust that header from Docker's address. For nginx, with its ",[150,525,528],{"href":526,"rel":527},"https:\u002F\u002Fnginx.org\u002Fen\u002Fdocs\u002Fhttp\u002Fngx_http_realip_module.html",[154],"realip module",":",[264,531,535],{"className":532,"code":533,"language":534,"meta":122,"style":122},"language-nginx shiki shiki-themes monokai","set_real_ip_from 192.168.65.1;\nreal_ip_header X-Forwarded-For;\n","nginx",[105,536,537,542],{"__ignoreMap":122},[272,538,539],{"class":274,"line":275},[272,540,541],{},"set_real_ip_from 192.168.65.1;\n",[272,543,544],{"class":274,"line":437},[272,545,546],{},"real_ip_header X-Forwarded-For;\n",[97,548,549,550,553],{},"macOS lets a program that isn't root listen on port 80 as long as it listens on all addresses, as Caddy does here with ",[105,551,552],{},":80",". Binding port 80 on one specific address fails with \"permission denied\" unless it runs as root.",[392,555,557],{"id":556},"_3-the-proxy-protocol-for-other-tcp-services","3. The PROXY protocol, for other TCP services",[97,559,560,561,566,567,570,571,574],{},"For mail, databases and other TCP services that don't speak HTTP, a proxy such as HAProxy can put the visitor's address in a ",[150,562,565],{"href":563,"rel":564},"https:\u002F\u002Fwww.haproxy.org\u002Fdownload\u002F1.8\u002Fdoc\u002Fproxy-protocol.txt",[154],"PROXY protocol"," header at the start of the connection. The service in the container has to support it: nginx (",[105,568,569],{},"listen 80 proxy_protocol","), Postfix and Dovecot do. Publish the container's port on ",[105,572,573],{},"127.0.0.1"," only, as in fix 2.",[97,576,577],{},"This doesn't help UDP.",[392,579,581],{"id":580},"_4-docker-on-linux","4. Docker on Linux",[97,583,584],{},"Docker Engine on a Linux machine, or in a Linux virtual machine with bridged networking so it has its own address on your LAN, forwards published ports without a relay. Containers there see the real address.",[113,586,588,592,598,640,658],{"className":587,"rounded":122,"max-width":123},[116,117,118,119,120,121],[125,589,591],{"id":590},"also-check-is-it-published-on-ipv6","Also check: is it published on IPv6?",[97,593,594,595,597],{},"A port published with an address, such as ",[105,596,169],{},", makes Docker Desktop listen on IPv4 only. IPv6 visitors are refused before they reach the relay. Leave the address out:",[264,599,601],{"className":420,"code":600,"language":422,"meta":122,"style":122},"services:\n  web:\n    image: nginx:stable-alpine\n    ports:\n      - \"80:80\"        # IPv4 and IPv6. \"0.0.0.0:80:80\" would be IPv4 only\n",[105,602,603,609,615,623,629],{"__ignoreMap":122},[272,604,605,607],{"class":274,"line":275},[272,606,430],{"class":429},[272,608,434],{"class":433},[272,610,611,613],{"class":274,"line":437},[272,612,440],{"class":429},[272,614,434],{"class":433},[272,616,617,619,621],{"class":274,"line":445},[272,618,448],{"class":429},[272,620,451],{"class":433},[272,622,455],{"class":454},[272,624,625,627],{"class":274,"line":458},[272,626,461],{"class":429},[272,628,434],{"class":433},[272,630,631,633,636],{"class":274,"line":466},[272,632,469],{"class":433},[272,634,635],{"class":454},"\"80:80\"",[272,637,639],{"class":638},"snpHw","        # IPv4 and IPv6. \"0.0.0.0:80:80\" would be IPv4 only\n",[97,641,642,643,646,647,650,651,653,654,657],{},"We tested both: with ",[105,644,645],{},"0.0.0.0",", IPv6 connections were refused; without it, ",[105,648,649],{},"docker ps"," showed the port on both ",[105,652,645],{}," and ",[105,655,656],{},"[::]",", and IPv4 and IPv6 visitors both reached the container.",[97,659,660,661,653,664,142],{},"If your Mac is behind CGNAT and you're working out how visitors reach it at all, see ",[150,662,663],{"href":20},"how to use a Mac mini as a home server",[150,665,666],{"href":22},"self-hosting behind CGNAT",[113,668,670,674,689,698,711,724,733],{"className":669,"rounded":122,"max-width":123},[116,117,118,119,120,121],[125,671,673],{"id":672},"frequently-asked-questions","Frequently Asked Questions",[675,676,679,683],"details",{"className":677},[678],"faq-item",[680,681,682],"summary",{},"Why does my Docker container on a Mac see 192.168.65.1?",[97,684,685,686,688],{},"Docker Desktop runs containers in a Linux virtual machine. A Docker process on your Mac accepts each connection to a published port and opens a new connection into the virtual machine, so the container sees the address of Docker's side of that second connection, ",[105,687,107],{}," with the default network settings. The visitor's address stays on the Mac.",[675,690,692,695],{"className":691},[678],[680,693,694],{},"Is 192.168.65.1 my router?",[97,696,697],{},"No. It's an address on Docker Desktop's internal network between your Mac and its Linux virtual machine. Your router and your LAN aren't involved. Every visitor to a published port shows up from it.",[675,699,701,704],{"className":700},[678],[680,702,703],{},"Does Docker Desktop's host networking fix it?",[97,705,706,707,710],{},"We haven't tested it. Docker's documentation says host networking in Docker Desktop 4.34 and later works at layer 4, and it doesn't say the client's address is kept. Docker's request to pass the original address to containers, ",[150,708,155],{"href":152,"rel":709},[154],", is still open.",[675,712,714,717],{"className":713},[678],[680,715,716],{},"Does OrbStack show the real client IP?",[97,718,719,720,723],{},"No. OrbStack has the same limitation, tracked as ",[150,721,376],{"href":374,"rel":722},[154],". Its maintainer wrote in July 2025 that this is not expected behaviour, but that internal limitations make it hard to fix. We haven't tested Colima or Rancher Desktop.",[675,725,727,730],{"className":726},[678],[680,728,729],{},"Does Docker on Linux have the same problem?",[97,731,732],{},"Usually not. On a Linux host, Docker forwards published ports with firewall rules that rewrite only the destination, so the container sees the visitor's real address. The problem comes from Docker Desktop's virtual machine, which Linux doesn't need.",[675,734,736,739],{"className":735},[678],[680,737,738],{},"How do I get the real client IP in nginx on Docker Desktop for Mac?",[97,740,741,742,653,745,748],{},"Put a reverse proxy on the Mac itself, outside Docker, that adds the X-Forwarded-For header, and publish the container's port on 127.0.0.1 only. Then tell nginx to trust that header from Docker's address with ",[105,743,744],{},"set_real_ip_from 192.168.65.1",[105,746,747],{},"real_ip_header X-Forwarded-For",". Or run nginx directly on macOS.",[125,750,752],{"id":751},"related-guides","Related guides",[130,754,755,761,767],{},[133,756,757,760],{},[150,758,759],{"href":20},"How to use a Mac mini as a home server",": setup, power, and how the internet reaches it",[133,762,763,766],{},[150,764,765],{"href":17},"How to expose Docker containers to the internet",": the options, compared",[133,768,769,772],{},[150,770,771],{"href":22},"Self-hosting behind CGNAT",": when your ISP blocks inbound connections",[774,775,776],"style",{},"html pre.shiki code .sHkqI, html code.shiki .sHkqI{--shiki-default:#A6E22E}html pre.shiki code .s7s5_, html code.shiki .s7s5_{--shiki-default:#AE81FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .s8I7P, html code.shiki .s8I7P{--shiki-default:#F92672}html pre.shiki code .sCdxs, html code.shiki .sCdxs{--shiki-default:#F8F8F2}html pre.shiki code .s_Ekj, html code.shiki .s_Ekj{--shiki-default:#E6DB74}html pre.shiki code .snpHw, html code.shiki .snpHw{--shiki-default:#88846F}",{"title":122,"searchDepth":437,"depth":437,"links":778},[779,780,781,782,783,784,790,791,792],{"id":127,"depth":437,"text":128},{"id":176,"depth":437,"text":177},{"id":209,"depth":437,"text":210},{"id":317,"depth":437,"text":318},{"id":347,"depth":437,"text":348},{"id":386,"depth":437,"text":387,"children":785},[786,787,788,789],{"id":394,"depth":445,"text":395},{"id":404,"depth":445,"text":405},{"id":556,"depth":445,"text":557},{"id":580,"depth":445,"text":581},{"id":590,"depth":437,"text":591},{"id":672,"depth":437,"text":673},{"id":751,"depth":437,"text":752},"2026-11-03","Containers in Docker Desktop for Mac log every visitor as 192.168.65.1. Why Docker's port relay hides the client's real IP, how to check, and what works.","md",[797,799,800,802,804,805],{"question":682,"answer":798},"Docker Desktop runs containers in a Linux virtual machine. A Docker process on your Mac accepts each connection to a published port and opens a new connection into the virtual machine, so the container sees the address of Docker's side of that second connection, 192.168.65.1 with the default network settings. The visitor's address stays on the Mac.",{"question":694,"answer":697},{"question":703,"answer":801},"We haven't tested it. Docker's documentation says host networking in Docker Desktop 4.34 and later works at layer 4, and it doesn't say the client's address is kept. Docker's request to pass the original address to containers, docker\u002Froadmap#157, is still open.",{"question":716,"answer":803},"No. OrbStack has the same limitation, tracked as orbstack#710. Its maintainer wrote in July 2025 that this is not expected behaviour, but that internal limitations make it hard to fix. We haven't tested Colima or Rancher Desktop.",{"question":729,"answer":732},{"question":738,"answer":806},"Put a reverse proxy on the Mac itself, outside Docker, that adds the X-Forwarded-For header, and publish the container's port on 127.0.0.1 only. Then tell nginx to trust that header from Docker's address with set_real_ip_from 192.168.65.1 and real_ip_header X-Forwarded-For. Or run nginx directly on macOS.",{},{"title":809,"icon":48,"description":810},"Docker on Mac Sees 192.168.65.1","Why containers in Docker Desktop for Mac see 192.168.65.1 instead of the client's IP address, and the fixes that work.",{"title":82,"description":794},"guides\u002Fself-hosting\u002Fdocker-desktop-mac-client-ip","aReO0RodKSfZKTgUuvFDvMcd094Lkj-kVYtzBoM0KgA",[815,834,880,894],{"path":15,"title":816,"icon":817,"children":818},"Find Your Public IP Address","mdi-folder",[819,825,830],{"path":12,"title":820,"navigation":821},"Get Your Public IP on Linux: One curl Command (2026)",{"title":822,"icon":823,"description":824},"Find your IP Address on Linux","mdi-penguin","Find your public and local IP address on Linux using curl, wget, dig, and built-in tools.",{"path":13,"title":826,"navigation":827},"How to Find Your IP Address on a Mac (Local and Public)",{"title":828,"icon":40,"description":829},"Find your IP Address on Mac","Find your local and public IP address on macOS in System Settings or Terminal, and check whether you're behind CGNAT.",{"path":14,"title":831,"navigation":832},"Find your IP Address on Windows",{"title":831,"icon":44,"description":833},"Find your public and local IP address on Windows using PowerShell and Command Prompt.",{"path":835,"title":836,"icon":817,"children":837},"\u002Fguides\u002Fself-hosting","Self Hosting",[838,840,845,851,857,862,868,874],{"path":16,"title":82,"navigation":839},{"title":809,"icon":48,"description":810},{"path":17,"title":841,"navigation":842},"How to Expose Docker Containers to the Internet (Without Port Forwarding)",{"title":843,"icon":48,"description":844},"Expose Docker Containers to the Internet","Four ways to make a Docker Compose stack reachable from the internet, and why a dedicated public IP needs no published ports at all.",{"path":18,"title":846,"navigation":847},"Expose a Home Server to the Internet: 5 Methods (2026)",{"title":848,"icon":849,"description":850},"Expose Your Home Server to the Internet","mdi-server-network","Five realistic methods to make your home server reachable from the internet, from port forwarding to a dedicated public IP.",{"path":19,"title":852,"navigation":853},"GetPublicIP vs Cloudflare Tunnel vs Tailscale for Self-Hosting",{"title":854,"icon":855,"description":856},"GetPublicIP vs Cloudflare vs Tailscale","mdi-compare","Compare GetPublicIP, Cloudflare Tunnel and Tailscale for self-hosting servers at home or the office.",{"path":20,"title":858,"navigation":859},"Mac mini Home Server: Setup, Power and Remote Access",{"title":860,"icon":40,"description":861},"Mac mini as a Home Server","Set up a Mac mini to run unattended as a home server, choose native apps or Docker, and make it reachable from the internet.",{"path":21,"title":863,"navigation":864},"Port Forwarding Not Working? 6 Causes & Fixes (2026)",{"title":865,"icon":866,"description":867},"Port Forwarding Not Working?","mdi-lan-disconnect","Diagnose the 6 most common reasons port forwarding fails and learn how to fix each one, including the hidden CGNAT problem.",{"path":22,"title":869,"navigation":870},"How to Self-Host Behind CGNAT: Bypass It (2026)",{"title":871,"icon":872,"description":873},"What is carrier grade NAT?","mdi-lan-pending","Learn what CGNAT is, how to check if you're behind it, which ISPs use it, and how to self-host a real public IP bypassing carrier-grade NAT.",{"path":23,"title":875,"navigation":876},"WireGuard Simple Watchdog Script",{"title":877,"icon":878,"description":879},"WireGuard Watchdog Script","mdi-shield-check","A simple watchdog script to monitor and restart WireGuard connections when network conditions change.",{"path":26,"title":881,"icon":817,"children":882},"Static Public IP Address",[883,889],{"path":24,"title":884,"navigation":885},"How to Get a Public IP Address (4 Methods, 2026)",{"title":886,"icon":887,"description":888},"How to get a public IP address","mdi-earth","What a public IP is, how to check yours, and 4 ways to get a dedicated public IP for self-hosting.",{"path":25,"title":890,"navigation":891},"How to get a static IP address",{"title":890,"icon":892,"description":893},"mdi-ip-network","We discuss what a static IP address is, what your options are to get one, and the best way to get a static IP address.",{"path":895,"title":896,"icon":817,"children":897},"\u002Fguides\u002Fuse-cases","Use Cases",[898,904],{"path":27,"title":899,"navigation":900},"Self-Hosting at Home - Privacy & Independence",{"title":901,"icon":902,"description":903},"Home Server Solutions","mdi-home-account","Build a sovereign personal cloud. Get a public IP address delivered to your home server so you can run your own email and chat services.",{"path":28,"title":905,"navigation":906},"Office Server Solutions & Benefits",{"title":907,"icon":849,"description":908},"Office Server Solutions","Discover why forward-thinking companies are moving specific workloads back to the office to reduce cloud spend and increase agility.",1793914025440]