Why Docker Loses Internet on VPN

Docker Desktop runs containers inside a Linux VM on your Mac. That VM has its own network routing that relies on macOS to reach the internet.

When VPN connects, it changes the macOS routing table. Docker's routes get overridden. Containers lose their path to the outside world.

Symptoms

You'll see these failures:

• •

  docker build fails downloading packages

• •

  apt-get update times out inside containers

• •

  curl from container returns nothing

• •

  pip install hangs indefinitely

• •

  Any network operation inside a container fails

Testing Container Connectivity

# Quick connectivity test
docker run --rm alpine ping -c 3 8.8.8.8

# DNS test
docker run --rm alpine nslookup google.com

# HTTP test
docker run --rm curlimages/curl curl -I https://google.com

Understanding the Network Flow

Normal flow: Container → Docker VM → macOS → Internet. With VPN: Container → Docker VM → macOS → VPN → broken.

The VPN doesn't know about Docker's internal networks (172.17.x.x). Traffic gets lost or blocked.

Fix 1: Restart Docker After VPN

Sometimes simply restarting Docker helps:

# Restart Docker Desktop from menu bar
# Or use terminal
killall Docker && open /Applications/Docker.app

This may re-establish routes, but it's a temporary fix at best.

Fix 2: Configure Docker DNS

If the issue is DNS-specific:

// ~/.docker/daemon.json
{
  "dns": ["8.8.8.8", "8.8.4.4"]
}

Restart Docker after making this change. Helps with DNS issues but doesn't fix routing.

Fix 3: Use Host Network (Limited)

docker run --network host myimage

This makes the container use host networking directly. But you lose container network isolation, and it's not practical for most use cases.

Fix 4: Route Docker Direct (Best)

The most reliable fix: route Docker Desktop outside the VPN tunnel entirely.

Building Images on VPN

# Dockerfile
FROM node:18
RUN npm install  # This needs internet access

Without a fix, builds hang at any network operation. With SplitTunnel, builds complete normally.

Docker Compose Considerations

# docker-compose.yml
services:
  web:
    build: .
    depends_on:
      - db
  db:
    image: postgres:15  # Needs to pull from registry

Both build stage and runtime need internet access. SplitTunnel fixes both.

Multi-Container Networking

• •

  Container-to-container: Usually unaffected by VPN

• •

  Container-to-internet: Fixed by SplitTunnel

• •

  Container-to-host: Works with direct routing

Verifying the Fix

After setting up SplitTunnel with Docker Desktop routed direct:

# Connect VPN

# Test connectivity
docker run --rm alpine ping -c 3 8.8.8.8
# Should succeed

# Test DNS
docker run --rm alpine nslookup google.com
# Should resolve

# Test a build
docker build -t test .
# Should complete normally