The Direct Solution: Bind OLLAMA_HOST to 0.0.0.0 and Add host-gateway

To resolve ConnectionRefusedError: [Errno 111] Connection refused when calling Ollama from a Docker container on Linux, execute two steps. First, rebind Ollama to listen on all network interfaces by adding Environment="OLLAMA_HOST=0.0.0.0:11434" to the systemd service. Second, pass --add-host=host.docker.internal:host-gateway to your Docker run command and target http://host.docker.internal:11434 instead of localhost.

Here are the exact terminal commands to configure the host systemd daemon:

# 1. Open the systemd override configuration for Ollama
sudo systemctl edit ollama.service

# 2. Paste the following block into the editor, then save and exit:
[Service]
Environment="OLLAMA_HOST=0.0.0.0:11434"

# 3. Reload systemd and restart the Ollama service
sudo systemctl daemon-reload
sudo systemctl restart ollama

# 4. Confirm Ollama is listening on 0.0.0.0 rather than 127.0.0.1
ss -tulpn | grep 11434
# Expected output: tcp LISTEN 0 4096 0.0.0.0:11434 0.0.0.0:*

Launch your container with the host bridge mapping:

docker run -it --rm \
  --add-host=host.docker.internal:host-gateway \
  -e OLLAMA_BASE_URL="http://host.docker.internal:11434" \
  python:3.12-slim \
  python3 -c "import urllib.request; print(urllib.request.urlopen('http://host.docker.internal:11434/api/tags').read().decode())"

Why 127.0.0.1 Fails Inside Docker on Linux

Linux network namespaces isolate container loopback interfaces from the host operating system. In our testbed running Docker 27.2 and Ollama 0.5.4 on Ubuntu 24.04 LTS, container connections fail for two distinct architectural reasons:

1. Localhost Isolation: Inside a Docker container, 127.0.0.1 points to the container’s private virtual network interface (eth0), not the physical host running the Ollama binary.
2. Default Localhost Socket Binding: By default, Ollama binds exclusively to 127.0.0.1:11434. Even if a container successfully routes packets to the host Docker bridge IP (172.17.0.1), the Ollama daemon rejects incoming TCP packets because they originate outside the host loopback adapter.

The table below contrasts container networking modes and their connectivity behavior against Ollama:

Docker Network Configuration	Host Address to Query	Security Profile	Linux Performance
Bridge with host-gateway	http://host.docker.internal:11434	High (Isolated container network)	Native TCP speed
Host Mode (--net=host)	http://127.0.0.1:11434	Low (Shared host port namespace)	Maximum (Zero bridge overhead)
Bridge with default 127.0.0.1	http://127.0.0.1:11434	Broken (Connection refused)	Fails immediately
Docker Compose with extra_hosts	http://host.docker.internal:11434	High (Declarative service isolation)	Native TCP speed

Docker Compose Production Configuration

If you run multi-container setups such as Open WebUI, Dify, or custom autonomous agent fleets using Docker Compose, declare extra_hosts under each service needing Ollama access.

Here is the production docker-compose.yml pattern:

version: "3.8"

services:
  ai-agent:
    image: my-coding-agent:latest
    container_name: coding-agent
    environment:
      - OLLAMA_HOST=http://host.docker.internal:11434
      - MODEL_NAME=deepseek-r1:14b
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped

  open-webui:
    image: ghcr.io/open-webui/open-webui:main
    container_name: open-webui
    ports:
      - "3000:8080"
    environment:
      - OLLAMA_BASE_URL=http://host.docker.internal:11434
    extra_hosts:
      - "host.docker.internal:host-gateway"
    restart: unless-stopped

Configuring Linux UFW Firewall Rules for Container Traffic

Binding Ollama to 0.0.0.0 exposes port 11434 to your local area network (LAN). If your Linux machine has an active Uncomplicated Firewall (ufw), block external public access while explicitly permitting requests from Docker’s virtual subnet (172.17.0.0/16):

# Verify current UFW status
sudo ufw status verbose

# Allow traffic originating specifically from the Docker bridge subnet
sudo ufw allow from 172.17.0.0/16 to any port 11434 proto tcp comment "Allow Docker containers to Ollama"

# Block unauthorized external LAN connections to Ollama
sudo ufw deny 11434/tcp comment "Block public access to Ollama API"

# Reload firewall rules
sudo ufw reload

Test connectivity from outside the machine with curl -s http://<LAN_IP>:11434/api/tags to ensure external requests are dropped, while internal Docker containers communicate freely with your local models.