If you are using Virtualbox as your hypervisor for the docker-machines, I suggest you set your network mode as Bridged Adapter. This way your VM will be connected to the network individually just like your own machine. Also to gather more information for troubleshooting try pinging the db host machine from the container machine command line. use docker exec -it <container-name> /bin/bash

Check your routing inside the Docker Machine VM with

docker-machine ssh default$ route -n

which looks like this on a fresh machine:

docker@default:~$ route -nKernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface0.0.0.0 10.0.2.2 0.0.0.0 UG 1 0 0 eth010.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0127.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 lo172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0192.168.99.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

If you've created a lot of networks, i.e. by using docker-compose it might have created routes to stacks, which conflict with your VPN or local network routes.

docker@dev15:~$ route -nKernel IP routing tableDestination Gateway Genmask Flags Metric Ref Use Iface0.0.0.0 10.0.2.2 0.0.0.0 UG 1 0 0 eth010.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0127.0.0.1 0.0.0.0 255.255.255.255 UH 0 0 0 lo172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0172.18.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-7400365dbd39172.25.0.0 0.0.0.0 255.255.0.0 U 0 0 0 br-4db568a601b4[...]192.168.80.0 0.0.0.0 255.255.240.0 U 0 0 0 br-97690a1b4313192.168.105.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1

TL;dr

It should be safe to remove all networks, with

docker network rm $(docker network ls -q)

since active networks are not removed by default ... but nonetheless be careful when running rm commands :)

I ran into this problem today and got AnyConnect to work without the need for split tunneling or a different VPN client like OpenConnect. All it took was a bit of port forwarding.

My Setup

• MacOS Sierra 10.12
• VirtualBox 5.0.26
• Docker ToolBox 1.12.2
• docker-vpn-helper script located at https://gist.github.com/philpodlevsky/040b44b2f8cee750ecc308271cb8d1ab

Instructions

1. The above software configuration was utilized when tested.

2. Make sure you don't have any VMs running and you are disconnected from the VPN.

3. Modify line 47 to either specify your insecure registry or delete the "--engine-insecure-registry :5000" parameter.

4. Execute the following in a shell on your Mac:

sudo launchctl unload /System/Library/LaunchDaemons/org.ntp.ntpd.plist

Workaround for MacOS Sierra. For some reason having NTP enabled causes the docker engine to hang. See:

https://forums.docker.com/t/docker-beta-for-mac-does-not-work-and-hangs-frequently-on-macos-10-12/18109/7

./docker-vpn-helper

Sets up the port forwarding, regenerates TLS certificates.

Pay attention to the following lines emitted by the script you will need to cut and paste them into your shell.

export DOCKER_HOST=tcp://localhost:2376export DOCKER_CERT_PATH=/Users/<username>/.docker/machine/machines/defaultexport DOCKER_MACHINE_NAME=default

Connect to your AnyConnect VPN and test out docker:

docker run hello-world