title: Docker: sending logs to localhost doesn't work but 0.0.0.0 does work, why?
body: <p>UPDATE: Now I have a problem. When a container was started before logstash the UDP logs do not arrive in logstash. According to this <a href="https://github.com/moby/moby/issues/8795" rel="nofollow noreferrer">bug report</a> this is because </p>
  
  <blockquote>
    <p>The linux kernel keeps state of each connection. Even though
    udp is connectionless</p>
  </blockquote>
  
  <p>as far as I understand it these connections are cached. Logstash receives a new IP and therefore no packages, this would not happen when I use localhost (instead of 0.0.0.0), as that IP never changes and docker forwards the messages to the exposed ports.</p>
  
  <p>Any idea how I can make it work with localhost (or a service name since I am using docker swarm)?</p>
  
  <hr>
  
  <p>I have a dockerized application (logstash) which publishes port 12201/udp to listen to logs. This accoring to the <a href="https://docs.docker.com/engine/reference/commandline/run/#options" rel="nofollow noreferrer">docker documentation</a> </p>
  
  <blockquote>
    <p>This binds port 8080 of the container to port 80 on 127.0.0.1 of the host machine.</p>
  </blockquote>
  
  <p>However if I send messages with netcat to localhost:12201/udp the application receives nothing. Whereas when I send messages to 0.0.0.0:12201/udp everything works as intended. </p>
  
  <p><strong>Why? Does this introduce performance/security issues? Could it be a bug?</strong></p>
  
  <p>As far as I know 0.0.0.0 is translated to all ip addresses of the machine and the machine has its own ip address and some 172.<em>.0.</em> addresses/networks which docker creates according to <a href="https://docs.docker.com/engine/userguide/networking/" rel="nofollow noreferrer">the docker container networking documentation.</a></p>
  
  <p>For some reason it seems that the published port is not mapped to localhost but some other network. I am running my application in a swarm and 0.0.0.0 works from any machine on the swarm.</p>
  
  <hr>
  
  <p>Here the relevant part of my compose file:</p>
  
  <pre><code>networks:
    logging:
  
  volumes:
      logging_data:
  
  services:
    logstash:
      image: docker.elastic.co/logstash/logstash:5.3.1
      logging:
        driver: "json-file"
      networks:
        - logging
      ports:
        - "12201:12201"
        - "12201:12201/udp"
      entrypoint: logstash -e 'input { gelf { } } output { stdout{ } elasticsearch { hosts =&gt; ["http://elasticsearch:9200"] } }'
      depends_on:
        - elasticsearch
  
  
      test:
      image: ubuntu
      networks:
        - logging
      logging:
        driver: gelf
        options:
          gelf-address: "udp://0.0.0.0:12201"
          tag: "log-test-tagi-docker"
      entrypoint: /bin/sh -c 'while true; do date +%H:%M:%S:%3N ; sleep 1; done'
      depends_on:
        - logstash
        - elasticsearch
  </code></pre>