docker - 无法从外部访问暴露的 docker 端口

Question

我正在尝试在 docker 中运行 apache2，但是当我公开端口时，该服务只能从主机访问，而不能从外部访问。

我已经通过以下方式执行了容器:

docker run -d -t -p 8080:80 --name ctf ubuntu

之后，我在里面安装了 apache2:

apt-get update && apt-get install apache2 -y && service apache2 start

当我运行 docker ps我会得到:

CONTAINER ID        IMAGE               COMMAND             CREATED             STATUS              PORTS                  NAMES 
c90b8ed41436        ubuntu              "/bin/bash"         3 minutes ago       Up 3 minutes        0.0.0.0:8080->80/tcp   ctf

我可以通过 wget <public ip>:8080 联系服务从那个主机。但是，如果我尝试从同一网络上的另一台设备上它不起作用。该服务无法访问。

还有命令 iptables --list将产生:

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             udp dpt:openvpn

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DOCKER-USER  all  --  anywhere             anywhere
DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  10.8.0.0/24          anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:http

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination
DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere
RETURN     all  --  anywhere             anywhere

你知道问题出在哪里吗？

编辑:


编辑2:
结果来自 netstat -ntlp ，似乎 docker 没有将套接字绑定(bind)到 IPv4:

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name     
tcp        0      0 0.0.0.0:10022           0.0.0.0:*               LISTEN      423/./ts3server
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      13863/mysqld
tcp        0      0 127.0.0.1:37995         0.0.0.0:*               LISTEN      15022/containerd
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1577/apache2
tcp        0      0 0.0.0.0:30033           0.0.0.0:*               LISTEN      423/./ts3server
tcp        0      0 0.0.0.0:8084            0.0.0.0:*               LISTEN      1552/mono
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      19145/systemd-resol
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1561/sshd
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      1577/apache2
tcp        0      0 0.0.0.0:10011           0.0.0.0:*               LISTEN      423/./ts3server      
tcp6       0      0 :::10022                :::*                    LISTEN      423/./ts3server
tcp6       0      0 :::8080                 :::*                    LISTEN      16111/docker-proxy
tcp6       0      0 :::30033                :::*                    LISTEN      423/./ts3server
tcp6       0      0 :::22                   :::*                    LISTEN      1561/sshd
tcp6       0      0 :::10011                :::*                    LISTEN      423/./ts3server

但这不应该是问题，因为:

root@ubuntu:~/docker# sysctl net.ipv6.bindv6only 
net.ipv6.bindv6only = 0
root@ubuntu:~/docker# sysctl net.ipv6.conf.all.forwarding 
net.ipv6.conf.all.forwarding = 1

Answer 1

问题是在当前 wifi 上，端口 8080 被过滤了 :( 抱歉