Support containers sharing a network namespace (issue #47)

docs/concepts/limitations.md

@@ -8,9 +8,7 @@ sidebar_label: "Limitations"
 ## EasyHAProxy will not work with --network=host
 
 :::danger Network Mode Incompatibility
-The `--network=host` option **cannot** be used with EasyHAProxy due to its networking requirements.
-
-EasyHAProxy needs to inspect and interact with Docker containers from within the Docker network where it's running. Using the `--network=host` option bypasses Docker networking, preventing EasyHAProxy from accessing and configuring containers effectively.
+The `--network=host` option **cannot** be used with the EasyHAProxy container itself due to its networking requirements.
 :::
 
 ## Considerations for Multiple Replica Deployments in EasyHAProxy

docs/getting-started/docker.md

@@ -9,7 +9,7 @@ EasyHAProxy inspects running Docker containers, reads their labels, and configur
 
 :::warning Limitations
 - You cannot mix Docker containers with Swarm containers.
-- This method does not work with containers that use the `--network=host` option. See [limitations](../concepts/limitations.md) for details.
+- EasyHAProxy itself cannot run with the `--network=host` option. See [limitations](../concepts/limitations.md) for details.
 :::
 
 ## Step 1 — Create a shared network
@@ -49,6 +49,32 @@ docker run -d \
 
 EasyHAProxy detects this container automatically and routes traffic from `example.org:80` to port 8080 in your container. You do not need to expose any container ports.
 
+### Containers using `--network=host`
+
+Containers that share the host network namespace (`--network=host`, or `network_mode: host` in
+Compose) cannot join the EasyHAProxy network, so EasyHAProxy reaches them through the gateway of
+its own network instead. Label them as usual, but set `localport` to the port the service binds
+**on the host**:
+
+```yaml
+services:
+  myapp:
+    image: my/image:tag
+    network_mode: host
+    labels:
+      easyhaproxy.myapp.host: example.org
+      easyhaproxy.myapp.port: 80
+      easyhaproxy.myapp.localport: 8080   # the port on the host
+```
+
+The same applies to containers sharing another container's namespace
+(`network_mode: "container:xxx"`, as used by VPN sidecars); those are reached at the address of
+the container owning the namespace.
+
+The service must bind `0.0.0.0` rather than `127.0.0.1`, otherwise it is unreachable from the
+EasyHAProxy container. If your host firewall blocks the Docker bridge, or the detected gateway is
+not the address you want, override it with `EASYHAPROXY_HOST_NETWORK_IP`.
+
 ## Step 4 — Verify
 
 Open `http://example.org` in your browser (or `curl http://example.org`). Traffic should reach your container.

docs/reference/environment-variables.md

@@ -9,6 +9,7 @@ sidebar_label: "Environment Variables"
 |---------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------|
 | EASYHAPROXY_DISCOVER      | How the services will be discovered to create `haproxy.cfg`:  `static`, `docker`, `swarm` or `kubernetes`                                                                                      | **required**       |
 | EASYHAPROXY_LABEL_PREFIX  | (Optional) The key will search for matching resources.                                                                                                                                         | `easyhaproxy`      |
+| EASYHAPROXY_HOST_NETWORK_IP | (Optional) Address used to reach containers running with `--network=host`. Defaults to the gateway of the EasyHAProxy network. | *auto*  |
 | EASYHAPROXY_BASE_PATH     | (Optional) Base directory for all EasyHAProxy files. All paths (config, certs, plugins, www) are constructed relative to this base.                                                            | `/etc/easyhaproxy` |
 | EASYHAPROXY_CERTBOT_*     | (Optional) Enable Let's Encrypt or any other ACME certificate. See more: [acme](../guides/acme.md)                                                                                             | *empty*            |
 | EASYHAPROXY_SSL_MODE      | (Optional) `strict` supports only the most recent TLS version; `default` good SSL integration with recent browsers; `loose` supports all old SSL protocols for old browsers (not recommended). | `default`          |