Support containers sharing a network namespace (issue #47)

docs/getting-started/docker.md

@@ -9,7 +9,7 @@ EasyHAProxy inspects running Docker containers, reads their labels, and configur
 
 :::warning Limitations
 - You cannot mix Docker containers with Swarm containers.
-- This method does not work with containers that use the `--network=host` option. See [limitations](../concepts/limitations.md) for details.
+- EasyHAProxy itself cannot run with the `--network=host` option. See [limitations](../concepts/limitations.md) for details.
 :::
 
 ## Step 1 — Create a shared network
@@ -49,6 +49,32 @@ docker run -d \
 
 EasyHAProxy detects this container automatically and routes traffic from `example.org:80` to port 8080 in your container. You do not need to expose any container ports.
 
+### Containers using `--network=host`
+
+Containers that share the host network namespace (`--network=host`, or `network_mode: host` in
+Compose) cannot join the EasyHAProxy network, so EasyHAProxy reaches them through the gateway of
+its own network instead. Label them as usual, but set `localport` to the port the service binds
+**on the host**:
+
+```yaml
+services:
+  myapp:
+    image: my/image:tag
+    network_mode: host
+    labels:
+      easyhaproxy.myapp.host: example.org
+      easyhaproxy.myapp.port: 80
+      easyhaproxy.myapp.localport: 8080   # the port on the host
+```
+
+The same applies to containers sharing another container's namespace
+(`network_mode: "container:xxx"`, as used by VPN sidecars); those are reached at the address of
+the container owning the namespace.
+
+The service must bind `0.0.0.0` rather than `127.0.0.1`, otherwise it is unreachable from the
+EasyHAProxy container. If your host firewall blocks the Docker bridge, or the detected gateway is
+not the address you want, override it with `EASYHAPROXY_HOST_NETWORK_IP`.
+
 ## Step 4 — Verify
 
 Open `http://example.org` in your browser (or `curl http://example.org`). Traffic should reach your container.