Home Assistant on Docker Compose without Network Mode Host

Installation
1

Hi everyone,

I’m running Home Assistant using Docker Compose, and for security reasons, I prefer not to enable the network_mode: host option. However, I’ve encountered a problem where many integrations, such as Apple TV, don’t work because broadcast packets aren’t received in this setup.

From my research, it seems that the root cause is the lack of proper handling for mDNS broadcasts within this configuration. A possible solution I found is to set up an mDNS repeater to bridge this gap, but I’m not sure how to proceed with this.

Could anyone provide specific guidance or examples of how to set up an mDNS repeater in conjunction with Docker Compose? Alternatively, are there other secure solutions that would allow me to use these integrations without relying on network_mode: host?

Thanks in advance for your help!

2

macvlan allows mdns

you must create macvlan network then attach your container to the network

3

To add some detail to the previous answer, macvlan gives the container it’s own virtual interface with it’s own MAC address, Just as if it were a separate device on your network.

Details on my setup here;

This setup worked fine on regular and raspberry flavored Debian 10/11, and is currently running on my Unraid server with only a couple of small tweaks.

Cheers.

4

I solved this by adding the below mDNS repeater config to my docker-compose. This method does require privileged mode for the repeater container, but maintains logical separation to the docker network as desired.

  mdns-repeater:
    container_name: mdns-repeater
    image: jdbeeler/mdns-repeater:latest
    network_mode: host  # Required for interface access
    privileged: true    # Full privileges required
    environment:
      USE_MDNS_REPEATER: 1
      EXTERNAL_INTERFACE: enp1s0   # Host's physical interface
      DOCKER_NETWORK_NAME: proxy   # Your bridge network
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
5

Sorry to bump, but found this because I’m considering the same. What are the security benefits you had in mind?

Connecting the container to an internal docker network still allows HA to reach out to things on your local network (ie, the host network it’s currently on). That’s inevitable for many integrations which connect to your local IoT devices. Suppose an attacker compromises your HA instance, host or not host won’t change much about what that attacker could do to your local network (correct me if I’m wrong). Not using host would mostly be an additional barrier for LAN-to-HA traffic, than the other way around (since the container would be behind Docker’s NAT).

I’m interested in not using host mainly for the attacker compromising HA scenario, because my HA is publicly accessible through a port forwarding, and I don’t want to use subscriptions or hassle with a VPN all the time. Security experts, please share your thoughts about the (in)effectivity of not using host for this scenario.