v2.2.0 regression: Docker HTTPS port forwards bound to 127.0.0.1 get ERR_CONNECTION_RESET #2507

Describe the bug

After upgrading to v2.2.0, Docker containers with HTTPS port bindings bound to a specific IP (127.0.0.1:443:443) receive an immediate TLS connection reset from the host. The connection was working correctly on v2.1.3 and is restored by downgrading.

The v2.2.0 release notes mention "Fixed Docker port forwards bound to specific IPs" — this change appears to have introduced the regression.

To Reproduce

1. Run an nginx container with a self-signed TLS cert and the following port binding:

   ports:
     - "127.0.0.1:80:80"
     - "127.0.0.1:443:443"

2. Add 127.0.0.1 dev.local to /etc/hosts
3. Visit https://dev.local in a browser → ERR_CONNECTION_RESET

Expected behavior

TLS connection is forwarded transparently to the container (as it was in v2.1.3).

Observed behavior

Connection is reset during TLS handshake. Diagnostics:

$ openssl s_client -connect 127.0.0.1:443 -servername dev.local
SSL handshake has read 0 bytes and written 1544 bytes
write:errno=54
no peer certificate available

lsof shows OrbStack listening on *:https — the TLS ClientHello reaches OrbStack's proxy but is reset before nginx ever sees it. The container works correctly when accessed from within the Docker network (bypassing OrbStack's port proxy), confirming the container and its TLS config are not at fault.

Workaround

Downgrade to v2.1.3.

OrbStack version

2.2.0 (2020000) — commit 0cd235b96a29195592ca86fbababff23d67abfd6

System info

• macOS: 26.3 (BuildVersion 25D125)
• CPU: arm64