linux - 连接到 docker 容器上公开的端口时连接被拒绝

Question

Dockerfile 如下所示:

FROM ubuntu:latest
LABEL Spongebob Dockerpants "s.dockerpants@comcast.net"
RUN apt-get update -y
RUN apt-get install -y python3-pip python3-dev build-essential

#Add source files
COPY . /app
ENV HOME=/app
WORKDIR /app

# Install Python web server and dependencies
RUN pip3 install -r requirements.txt

ENV FLASK_APP=app.py

# Expose port
EXPOSE 8090
#ENTRYPOINT ["python3"]
CMD ["python3", "app.py"]
CMD tail -f /dev/null

我像这样启动了容器:

docker run --name taskman -p 8090:8090 -d task-manager-app:latest

我看到容器正在运行，并且我的本地主机正在监听 8090:

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ docker ps
CONTAINER ID        IMAGE                     COMMAND                  CREATED              STATUS              PORTS                    NAMES
c1ac5cb27698        task-manager-app:latest   "/bin/sh -c 'tail -f…"   About a minute ago   Up About a minute   0.0.0.0:8090->8090/tcp   taskman

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ sudo netstat -nlp | grep 8090
tcp6       0      0 :::8090                 :::*                    LISTEN      1154/docker-proxy   

我尝试根据我发出的 docker run 命令通过 localhost 访问容器上的 8090，但收到“连接被拒绝”

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ curl http://localhost:8090
curl: (56) Recv failure: Connection reset by peer

然后我检查了端口绑定(bind)，看起来没问题:

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ sudo docker port c1ac5cb27698 8090
0.0.0.0:8090

当我执行 docker inform 时，我看到这个:

$ docker inspect c1ac5cb27698 | grep -A 55 "NetworkSettings"
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "7c2249761e4f48eef373c6744161b0709f312863c94fdc17138913952be698a0",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "8090/tcp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "8090"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/7c2249761e4f",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "ea7552d0ba9e8f0c865fa4a0f24781811c7332a1e7473c48e88fa4dbe6e5e05d",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "172.17.0.2",
            "IPPrefixLen": 16,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:02",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "cfb5be57fdeed8a08b1650b5706a00542c5249903ce33052ff3f0d3dab619675",
                    "EndpointID": "ea7552d0ba9e8f0c865fa4a0f24781811c7332a1e7473c48e88fa4dbe6e5e05d",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.2",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:02",
                    "DriverOpts": null
                }
            }
        }
    }

我能够从本地主机 ping 容器:

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.
64 bytes from 172.17.0.2: icmp_seq=1 ttl=255 time=0.045 ms
64 bytes from 172.17.0.2: icmp_seq=2 ttl=255 time=0.042 ms
64 bytes from 172.17.0.2: icmp_seq=3 ttl=255 time=0.047 ms
^C
--- 172.17.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2053ms
rtt min/avg/max/mdev = 0.042/0.044/0.047/0.008 ms

配置中是否有任何内容会导致这些连接被拒绝？绑定(bind)有问题吗？

Answer 1

您的 docker 文件包含两行 CMD 行，但 docker 只会遵循最新的一行。

CMD ["python3", "app.py"]
CMD tail -f /dev/null

在容器内执行的实际命令是 tail 命令，它不会绑定(bind)和监听端口。您可以 ping 容器，因为使用 tail 命令容器处于事件状态。