In docker container - [Agent] Refused: A TLS connection is registered on the monitoring server but the agent is not providing it

CMK version: Checkmk Raw Edition 2.4.0p15
OS version: Ubuntu 24.04 (WSL2 for Windows 11)

Error message: Refused: A TLS connection is registered on the monitoring server but the agent is not providing it

I was trying out Checkmk for the first time and was following along the beginner’s guide. I am running Checkmk inside a docker container running in WSL Ubuntu 24.04.
I then installed the cmk agent directly inside the WSL and performed the registration. The output was the following:

Connection: localhost/cmk
UUID: 83f9aa73-0b5b-4052-9906-f49f71ec8ab3
Local:
Connection mode: pull-agent
Connecting to receiver port: 8000
Certificate issuer: Site ‘cmk’ agent signing CA
Certificate validity: Wed, 12 Nov 2025 13:09:53 +0000 - Tue, 12 Nov 2030 13:09:53 +0000
Remote:
Connection mode: pull-agent
Hostname: localhost

When I run the connection test for the host inside the checkmk interface I get a successful ping and traceroute but in the agent logs the error is the following: Refused: A TLS connection is registered on the monitoring server but the agent is not providing it.

If I run checkmk directly inside the docker container everything works fine. Am I misinterpreting the setup steps? I think that checkmk is trying to communicate with an agent inside its docker container when connecting to the host “localhost”. Is there a way for it connect to the agent in the WSL?

Running the docker container in network “host” mode works correctly.

I managed to get it working in bridge mode by figuring out the IP address of the docker host on the “docker0” network interface and used that address to setup both the host on the site and the agent. It seems to be working.

Is there a better way to do this?