Container reaching Mac via SSH tunnel needs 3 things not just 1

To make a Docker container on a Linux VM reach a service running on the Mac (which is behind home NAT, so reverse tunnel is mandatory), THREE separate things have to align — and getting any one wrong gives the same silent timeout symptom. (1) The SSH reverse tunnel binds on the VM s 127.0.0.1 by default. Containers on user-defined docker bridges CANNOT reach that — they only reach the host via their bridge gateway IP. Need a relay like socat to bind on the bridge gateway and forward to localhost: socat TCP-LISTEN:port,bind=172.18.0.1,fork,reuseaddr TCP:127.0.0.1:tunnel_port. (2) The bridge gateway IP is NOT always 172.17.0.1. That is only the DEFAULT bridge. User-defined networks (anything created via docker network create or a compose file with a custom network) get DIFFERENT subnets — typically 172.18.x, 172.19.x, etc. Always docker inspect <container> --format "{{range .NetworkSettings.Networks}}{{.Gateway}}{{end}}" to get the actual gateway. (3) UFW will silently drop container-to-host traffic on un-allowed ports even though the connection never leaves the physical machine. Need an explicit ufw allow from <bridge-subnet> to any port <port>. Without all three, the chain shows healthy at every individual layer (whisper-server up, SSH tunnel binding, socat binding) but the container hits a 5+ second timeout on the final hop.