Fix show_toolbar_with_docker on runtimes with unrelated host address (#2422)

* Fix show_toolbar_with_docker on runtimes with unrelated host address

show_toolbar_with_docker derived the Docker host address by resolving
host.docker.internal and replacing the last segment with .1. Runtimes
such as OrbStack resolve that name to an address outside the container
network (0.250.250.254), so the derived address never matches
REMOTE_ADDR and the toolbar stays hidden.

Fall back to deriving the gateway from the container's own addresses
when the host.docker.internal probe does not match.

* Reworked show_toolbar_with_docker to support falling through

* Add runtimes to spelling words list

* Document the host-guess caveat for show_toolbar_with_docker

* Add comment in case someone copies this logic

---------

Co-authored-by: Tim Schilling <schillingt@better-simple.com>

Author: Sanjays2402

debug_toolbar/middleware.py

@@ -44,11 +44,9 @@ def show_toolbar_with_docker(request: HttpRequest) -> bool:
     if not settings.DEBUG:
         return False
 
-    # Test: settings
     if request.META.get("REMOTE_ADDR") in settings.INTERNAL_IPS:
         return True
 
-    # Test: Docker
     try:
         # This is a hack for docker installations. It attempts to look
         # up the IP address of the docker host.
@@ -64,7 +62,22 @@ def show_toolbar_with_docker(request: HttpRequest) -> bool:
         # It's fine if the lookup errored since they may not be using docker
         pass
 
-    # No test passed
+    # Some Docker runtimes (for example OrbStack) resolve host.docker.internal
+    # to an address that is unrelated to the container network, so the check
+    # above cannot derive the host address from it.
+    try:
+        # Make a reasonable guess at the gateway from the container's own
+        # interface. This assumes the process is running inside a container.
+        # If this were used outside a container this would grant access to
+        # anything that appears to come from the network's gateway (router).
+        container_ips = socket.gethostbyname_ex(socket.gethostname())[2]
+        gateways = {ip.rsplit(".", 1)[0] + ".1" for ip in container_ips}
+        if request.META.get("REMOTE_ADDR") in gateways:
+            return True
+    except socket.gaierror:
+        # It's fine if the lookup errored since they may not be using docker
+        pass
+
     return False
 
 

docs/changes.rst

@@ -9,6 +9,9 @@ Pending
   older versions of Django, the panel explains that upgrading is required.
 * Fixed the Django version check in the SQL panel test suite for Django's
   boolean parameter handling.
+* Fixed ``show_toolbar_with_docker`` on Docker runtimes such as OrbStack that
+  can resolve ``host.docker.internal`` to an address outside the container
+  network.
 * Restored the select and explain buttons for queries that run without
   parameters.
 * Fixed the error shown when panel content fails to load, which could not

docs/installation.rst

@@ -163,6 +163,13 @@ option.
     Docker gateway IP and treat it as an allowable internal IP so that the
     toolbar is shown to you.
 
+    When the Docker host lookup fails, the ``show_toolbar_with_docker``
+    callback guesses the host's address from the container's own network. If
+    run outside a container that guess can resolve to another machine on your
+    network, granting it access to the toolbar's data. The
+    ``show_toolbar_with_docker`` callback should only be used inside a
+    container.
+
 7. Disable the toolbar when running tests (optional)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 

docs/spelling_wordlist.txt

@@ -62,6 +62,7 @@ refactoring
 reinitializing
 resizing
 runserver
+runtimes
 spellchecking
 sphinxcontrib
 spooler

tests/test_integration.py

@@ -89,6 +89,21 @@ def test_show_toolbar_docker(self, mocked_gethostbyname):
             self.assertTrue(show_toolbar_with_docker(self.request))
         mocked_gethostbyname.assert_called_once_with("host.docker.internal")
 
+    @patch("socket.gethostbyname", return_value="0.250.250.254")
+    @patch("socket.gethostname", return_value="container")
+    @patch(
+        "socket.gethostbyname_ex",
+        return_value=("container", [], ["192.168.215.7"]),
+    )
+    def test_show_toolbar_docker_unrelated_host_address(self, *mocks):
+        """Runtimes such as OrbStack resolve host.docker.internal to an
+        address outside of the container network, so the host address has to
+        be derived from the container's own address instead."""
+        self.request.META["REMOTE_ADDR"] = "192.168.215.1"
+        with self.settings(INTERNAL_IPS=[]):
+            self.assertFalse(show_toolbar(self.request))
+            self.assertTrue(show_toolbar_with_docker(self.request))
+
     def test_not_iterating_over_INTERNAL_IPS(self):
         """Verify that the middleware does not iterate over INTERNAL_IPS in some way.