docker - 为什么使用 DOCKER_OPTS ="--iptables=false"会破坏 docker-compose 的 DNS 发现？

Question

当我将此行添加到我的/etc/default/docker 时

DOCKER_OPTS="--iptables=false"

然后 DNS 不再工作。由 docker compose 启动的一组容器再也找不到彼此了:

version: '2'
services:
    elasticsearch:
       image: elasticsearch:latest
       volumes:
          - ./esdata:/usr/share/elasticsearch/data
    kibana:
       image: kibana:latest
       environment:
          - ELASTICSEARCH_URL=http://elasticsearch:9200

当设置 iptables=false 时，上述停止工作。 kibana 容器无法“找到” Elasticsearch 容器。但是当被移除(并且 docker 引擎重新启动)时，这工作正常。

这是为什么？

(更重要的是，为什么使用ufw时iptables=false不是默认设置？？)

谢谢

Answer 1

来自 https://docs.docker.com/v1.5/articles/networking/#between-containers

Whether a container can talk to the world is governed by two factors.

1. Is the host machine willing to forward IP packets? This is governed by the ip_forward system parameter. Packets can only pass between containers if this parameter is 1. Usually you will simply leave the Docker server at its default setting --ip-forward=true and Docker will go set ip_forward to 1 for you when the server starts up.

2. Do your iptables allow this particular connection? Docker will never make changes to your system iptables rules if you set --iptables=false when the daemon starts. Otherwise the Docker server will append forwarding rules to the DOCKER filter chain.

Docker will not delete or modify any pre-existing rules from the DOCKER filter chain. This allows the user to create in advance any rules required to further restrict access to the containers.

来自 https://docs.docker.com/engine/installation/linux/ubuntulinux/#enable-ufw-forwarding

If you use UFW (Uncomplicated Firewall) on the same host as you run Docker, you’ll need to do additional configuration. Docker uses a bridge to manage container networking. By default, UFW drops all forwarding traffic. As a result, for Docker to run when UFW is enabled, you must set UFW’s forwarding policy appropriately.

我认为你的案例的整个配方是:

1. DEFAULT_FORWARD_POLICY="ACCEPT"
2. DOCKER_OPTS="--iptables=false"
3. 在 iptables 中配置 NAT

更多详情您可以查看Running Docker behind the ufw firewall