PSA: discovery and Syncthing in a container: use docker host networking

[bdlow (Ben)]

I just spent a little while chasing my tail, ending up back where I should have started: the doc linked from the docker image doc. As noted therein, discovery won’t work if you use Docker’s standard NAT/port mapping; you’ll need to use host networking. (though why does that doc give the port-mapping version as an example?)

One thing that threw me a little was the discussion in How do I advertise addresses for clients to connect to but the solution therein (adding the host address to the listen address) won’t work: Syncthing inside the standard container/docker networking mode (bridging, NAT) can’t see / doesn’t know of the host’s network interfaces and thus can’t listen on or advertise them.

[bt90]

v2: Docker host network mode as default

This is more of a documentation thing if anything and not strictly tied to v2. But people will have a closer look at their deployments with v2 and I hope we can guide some of them towards a better setup. We already have a documentation section that covers the host networking mode and how it improves discovery: Can we just adapt our CLI and Compose examples in the top section to also use host network mode by default? Most people tend to simply copy&paste the very first Compose bits and end up…

Guess I need to finally get this done

[broizter]

Using Docker’s host networking mode eliminates the network isolation between the container and the host. Whether this is a concern depends on your specific threat model and use case though.