How to fix dial tcp: connect: host is unreachable in Docker

What this error means

The "dial tcp: connect: host is unreachable" error indicates that Docker attempted to connect to a remote host but the network packets could not reach their destination. This is a low-level network error that occurs before any connection is even attempted—the network layer simply cannot find a route to the target IP address. This error can appear in several scenarios: - When pulling images from Docker Hub or other registries - When containers try to communicate with external services - During inter-container communication across different networks - When pushing images to a remote registry The "host is unreachable" message is distinct from "connection refused" (where the host is reachable but not accepting connections) or "connection timed out" (where packets are sent but no response is received). This error means the network stack on the Docker host or container determined there is no valid route to the destination.

Typical symptoms

• Docker pull commands fail with 'dial tcp: connect: host is unreachable'
• Containers cannot reach external services or APIs
• docker build fails when downloading packages or dependencies
• Container-to-container communication fails across different Docker networks
• docker push fails to connect to registry
• Commands work on the host but fail inside containers
• Intermittent connectivity issues where some destinations work but others don't
• Error appears specifically after VPN connection or network changes

Common causes

1. IP forwarding is disabled on the Docker host (net.ipv4.ip_forward=0)
2. Firewall rules (iptables/nftables/firewalld) blocking Docker traffic
3. Docker bridge network (docker0) IP range conflicts with host network
4. VPN or proxy interfering with Docker network routing
5. DNS resolution failing inside containers
6. MTU mismatch between Docker network and host network
7. IPv4/IPv6 configuration mismatch when server only has IPv6
8. Incorrect Docker network configuration or corrupted network state

How to fix "dial tcp: connect: host is unreachable"

# Check current IP forwarding status
sysctl net.ipv4.ip_forward

# If it returns 0, enable it temporarily
sudo sysctl -w net.ipv4.ip_forward=1

echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

sudo systemctl restart docker

# View current rules
sudo iptables -L -v -n

# Allow Docker bridge traffic
sudo iptables -A FORWARD -i docker0 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o docker0 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Add docker0 to trusted zone
sudo firewall-cmd --permanent --zone=trusted --add-interface=docker0
sudo firewall-cmd --reload

# Allow Docker networks
sudo ufw allow from 172.16.0.0/12
sudo ufw allow from 10.0.0.0/8

# Run an alpine container with network tools
docker run --rm -it alpine sh

# Inside the container, test connectivity
ping -c 3 8.8.8.8      # Test raw IP connectivity
ping -c 3 google.com   # Test DNS resolution
wget -O- http://example.com  # Test HTTP

docker run --rm --dns 8.8.8.8 alpine ping -c 3 google.com

# Edit Docker daemon configuration
sudo nano /etc/docker/daemon.json

{
  "dns": ["8.8.8.8", "8.8.4.4", "1.1.1.1"]
}

sudo systemctl restart docker

# Check Docker's network configuration
docker network inspect bridge

# Check host routes
ip route

{
  "bip": "192.168.100.1/24",
  "default-address-pools": [
    {"base": "192.168.101.0/24", "size": 24}
  ]
}

sudo systemctl restart docker

# Check host MTU
ip link show eth0

# Check Docker bridge MTU
ip link show docker0

{
  "mtu": 1400
}

sudo systemctl restart docker

networks:
  default:
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: 1400

docker run --network host your-image

# Stop all containers
docker stop $(docker ps -aq)

# Remove all containers
docker rm $(docker ps -aq)

# Prune networks
docker network prune -f

# Stop Docker
sudo systemctl stop docker

# Remove Docker network files (Docker will recreate them)
sudo rm -rf /var/lib/docker/network

# Start Docker
sudo systemctl start docker

# Check if you have IPv4 connectivity
ip -4 addr show

# If no IPv4 address, that's the issue

# Edit /etc/sysctl.conf
sudo nano /etc/sysctl.conf

net.ipv6.conf.all.disable_ipv6=1
net.ipv6.conf.default.disable_ipv6=1

sudo sysctl -p
sudo systemctl restart docker

Advanced notes

# Trace the route to see where it fails
traceroute registry-1.docker.io

# Check routing table
ip route show

# Monitor network traffic
sudo tcpdump -i docker0 -n

# Check iptables NAT rules (Docker uses these)
sudo iptables -t nat -L -v -n

# Connect container to multiple networks
docker network connect my-network container-name

# Or create an overlay network for multi-host
docker network create --driver overlay my-overlay

Frequently asked questions

What does "dial tcp: connect: host is unreachable" mean?

The "dial tcp: connect: host is unreachable" error indicates that Docker attempted to connect to a remote host but the network packets could not reach their destination. This is a low-level network error that occurs before any connection is even attempted—the network layer simply cannot find a route to the target IP address. This error can appear in several scenarios: - When pulling images from Docker Hub or other registries - When containers try to communicate with external services - During inter-container communication across different networks - When pushing images to a remote registry The "host is unreachable" message is distinct from "connection refused" (where the host is reachable but not accepting connections) or "connection timed out" (where packets are sent but no response is received).

How do I fix "dial tcp: connect: host is unreachable"?

The 'dial tcp: connect: host is unreachable' error occurs when a Docker container cannot establish a network connection to a target host. This is typically caused by network configuration issues, firewall rules, incorrect IP forwarding settings, or DNS resolution problems.

What causes "dial tcp: connect: host is unreachable"?

IP forwarding is disabled on the Docker host (net.ipv4.ip_forward=0) Firewall rules (iptables/nftables/firewalld) blocking Docker traffic Docker bridge network (docker0) IP range conflicts with host network

Is the "dial tcp: connect: host is unreachable" error serious?

It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Related errors

• Error response from daemon: Get https://registry-1.docker.io/v2/: Proxy Authentication Required

  How to fix 'Proxy Authentication Required' in Docker

  MEDIUM

• Health check timed out

  How to fix 'Health check timed out' in Docker

  MEDIUM

• Hardware assisted virtualization and data execution protection must be enabled in the BIOS

  How to fix 'Hardware assisted virtualization must be enabled in the BIOS' in Docker

  HIGH

• Container is starting (health: starting)

  How to fix 'Container is starting (health: starting)' in Docker

  LOW

• WSL 2 requires an update to its kernel component

  How to fix 'WSL 2 requires an update to its kernel component' in Docker

  MEDIUM

• dial tcp: i/o timeout

  How to fix 'dial tcp: i/o timeout' in Docker

  MEDIUM

Official resources & further reading

• 📚Docker Official Documentation
• 📖
  Docker Networking Overview - Docker Docs(Official Docs)
• 📖
  Use bridge networks - Docker Docs(Official Docs)
• 💬
  Docker error network is unreachable - Docker Community Forums(Stack Overflow)
• 💬
  Network unreachable inside docker container without --net=host parameter - Stack Overflow(Stack Overflow)
• 💬
  Host unreachable inside Docker container - Stack Overflow(Stack Overflow)
• 📝
  Troubleshooting Docker 'network is unreachable' - TechKluster
• 📝
  100 Common Docker Errors & Solutions - DEV Community