Podman-hosted containers may not be able to reach Aspire services

[timheuer]

Using the HealthChecksUI sample in the dotnet/aspire-samples repo and Podman, the HealthChecks UI dashboard was not able to reach the healthchecks URIS:

with looking at the logs exceptions:

GetHealthReport threw an exception when trying to get report from http://host.containers.internal:61669/healthz configured with name webfrontend.
      System.Net.Http.HttpRequestException: Connection refused (host.containers.internal:61669)
       ---> System.Net.Sockets.SocketException (111): Connection refused

This appears to be a common issue with Podman 5+ presently: containers/podman#22237

This operates differently when just using Docker and the host.docker.internal URIs don't seem to be impacted, but Podman and the mappings used in the Podman machine network config seem to impact these situations where a container needing to accessing something at the host.containers.internal URI may fail given this issue.

[NikiforovAll]

The issue also reproduces when I attempt to access Postgres using PgAdmin. Is there a possible workaround for this problem?

---

Context:
Podman Desktop for my Windows 10 machine using WSL

[karolz-ms]

Putting on backlog since this is mostly an external Podman issue.

@NikiforovAll I cannot think of a simple workaround at the moment, sorry.

[mitchdenny]

Related: #5510

[arielmoraes]

@karolz-ms I'm having a similar issue when trying to make Docker containers reach the host projects. The Aspire proxy does not seem to listen on all interfaces causing a Connection Refused:

The only working IP is 127.0.0.1 as expected, but when using host.docker.internal you can have two scenarios:

1. When accessing host.docker.internal from the host itself it resolves to the machine's IP address (default configuration)
2. When accessing from a container it resolves to the host IP associated with the Docker network

So the request won't be accepted if the Aspire proxy does not listen on all interfaces.

[karolz-ms]

@arielmoraes correct. Aspire proxy listens on localhost-related interfaces by default.

@mitchdenny @davidfowl I was going to follow with "you can add an Endpoint with a host address that refers to the Docker bridge network" but I noticed that the EndpointAnnotation does not have an "address" property. So it does not seem possible from the app model to bind to arbitrary (host) network interface. Am I correct, and if yes, is this something we should enable?

[davidfowl]

This is a container to host problem that we need to figure out how to address that problem in both WSL and podman.

[davidfowl]

The fixes we made to Aspire 9 will make things like pgadmin, pgweb, redis commander etc will work out of the box using container to container networking. The edge cases are around container to executable/project networking. We will address that post 9.

[atrauzzi]

#6846 and #6635 related?