Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteWhere a service runs—and which way a connection is going—determines which address and port to use. Windows can usually reach a service in WSL 2 through localhost; reaching a Docker Desktop container requires publishing a port; and a container connecting back to a Windows service uses host.docker.internal. These paths cross distinct networking contexts, so the right fix depends on the source and destination of the connection.
Which networking layer is involved?
With Docker Desktop and Linux containers, think of the connection as crossing separate environments: the Windows host, a WSL 2 distribution, Docker Desktop’s Linux VM, and the container. A service running directly in your WSL distribution is not the same as one running inside a container. Docker Desktop forwards published container ports through its backend and Linux VM; WSL’s localhost forwarding is a separate feature.
As an Amazon Associate I earn from qualifying purchases.
| Connection direction | Address or setting to use |
|---|---|
| Windows → service running directly in WSL 2 | localhost:<port> with the default NAT setup and localhost forwarding enabled |
| Windows → Docker Desktop container | Publish a port, then connect to the published host port, commonly through localhost:<host-port> |
| WSL Linux process → Windows service under NAT | The Windows host IP, obtainable from WSL’s default route |
| Container → Windows-hosted service | host.docker.internal:<port> |
Reach a service running directly in WSL from Windows
In the default WSL 2 NAT configuration, start the service in the distribution and open http://localhost:<port> from Windows. WSL localhost forwarding is enabled by default. If the connection fails, first confirm the process is running and listening on the intended port and interface. Then check the localhostForwarding setting in %UserProfile%.wslconfig; setting it to true enables the documented forwarding behavior.
Free tools Windows power users keep installed
One-click scans. No signup required.
To query a distribution’s IP from Windows, run:
wsl.exe --distribution <DistroName> hostname -I
That is the distribution’s address. It is not the Windows host address that a Linux process needs when it connects in the opposite direction under NAT.
Connect from WSL to a service on Windows
Under NAT, Linux-to-Windows traffic does not use the same localhost-forwarding path as Windows-to-WSL traffic. From the WSL shell, get the Windows host address from the default route:
ip route show | grep -i default | awk '{ print $3}'
Use the returned address with the Windows service’s listening port. The Windows service must also be listening on an interface reachable from WSL, and firewall rules must permit the connection.
Publish a Docker Desktop container port to Windows
A Docker port mapping has the form HOST_PORT:CONTAINER_PORT. The container-side port must match the port on which the application listens inside the container; the host-side port can be different. For example, this maps Windows loopback port 8080 to port 80 in an Nginx container:
Rank #3
docker run --rm -p 127.0.0.1:8080:80 nginx
Open http://localhost:8080 on the Windows host. Docker Desktop accepts the connection and forwards it through its backend and Linux VM to the container.
For a mapping intended to listen on all host interfaces, use -p 8080:80. That broad binding can make the service reachable from other machines, depending on network configuration and firewall rules. Use the explicit 127.0.0.1 binding when only local host access is intended.
Rank #4
Published, exposed, and randomly assigned ports
| Option | What it does | Host port behavior |
|---|---|---|
EXPOSE in a Dockerfile or --expose |
Documents or exposes a container port to Docker networking; it does not by itself publish that port to the host. | No host mapping is created by this option alone. |
-p HOST_PORT:CONTAINER_PORT |
Publishes a specified container port to a specified host port. | Fixed host port; without a host IP, Docker binds all host interfaces by default. |
-P |
Publishes ports marked exposed to host ports selected by Docker. | Randomly selected host ports; inspect the mapping with docker port. |
Connect from a container to a Windows-hosted service
From a Docker Desktop container, use host.docker.internal as the hostname for a service on the Docker Desktop host—for example, host.docker.internal:5000 for a service listening on port 5000. This is the container-to-host direction. It does not publish a port for incoming connections to the container; use a Docker port mapping for that.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose between WSL NAT and mirrored networking
NAT is the WSL default. Microsoft documents mirrored networking for Windows 11 version 22H2 and later. In mirrored mode, Windows and WSL can use IPv4 127.0.0.1 for the documented localhost connection path; ::1 is not supported for that path. The mode also adds IPv6 support, improves VPN compatibility, supports multicast, and allows direct LAN access to WSL. LAN reachability still depends on firewall policy.
Best Value
| Consideration | NAT | Mirrored |
|---|---|---|
| Default and eligibility | Default WSL networking mode. | Requires Windows 11 version 22H2 or later. |
| Windows ↔ WSL localhost | Windows can generally reach WSL services through localhost forwarding. For Linux-to-Windows connections, use the Windows host IP from the default route. | The documented Windows/WSL localhost route uses IPv4 127.0.0.1; ::1 is unsupported for this path. |
| Additional networking needs | Does not provide the mirrored-mode benefits listed by Microsoft. | Adds IPv6 support, improved VPN compatibility, multicast, and direct LAN access to WSL. |
| Docker Desktop published-port caveat | The documented mirrored-mode issue does not apply as stated. | Microsoft documents a published-port failure at container creation under the default namespace; see the troubleshooting section. |
WSL’s configuration reference lists nat, mirrored, none, deprecated bridged, and consomme as networkingMode values. To switch modes, edit %UserProfile%.wslconfig; for example, use networkingMode=mirrored for mirrored mode. Check the configuration reference for the applicable settings before changing networking behavior.
Quick Recap
Troubleshoot a port that will not open
- Locate the service. Decide whether it runs directly in the WSL distribution or inside a Docker container. The WSL guest, Docker Desktop Linux VM, and container are different networking contexts.
- Check the listener. Confirm that the service is running on the port you expect. For a container, verify that the application listens on the container-side port in the mapping and on an interface reachable through the container network.
- Verify publication. Inspect the Docker run command or Compose configuration.
EXPOSEalone does not publish a container port to the host; create a host-to-container mapping with-por the equivalent Compose setting. If using-P, rundocker portto find the selected host port. - Match the address to the direction. For Windows-to-WSL under NAT, try
localhost. For Windows-to-container, connect to the published host port. For a container-to-Windows connection, usehost.docker.internal. For WSL-to-Windows under NAT, use the Windows host IP from the default route. - Check binding and firewall rules. A service listening only on an unsuitable interface may not accept forwarded traffic. Docker’s host-side mapping without an explicit host IP binds all host interfaces by default; use
127.0.0.1to restrict it to host loopback. For inbound access beyond the local host, review Windows Firewall and, where applicable, Hyper-V firewall rules. - If mirrored mode is involved, check the known issue. Microsoft documents a Docker Desktop published-port failure during container creation under the default namespace. Its listed workarounds are
--network hostor the experimentalignoredPortssetting. Check Microsoft’s current WSL troubleshooting guidance before using either workaround: host networking changes the container’s network isolation and port-publishing behavior, whileignoredPortsis experimental.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
