容器中如何能访问到宿主机的端口？

宿主机启动了一个 node 服务，端口 8001,nginx 为容器，配置反代访问不到宿主机系统 Ubuntu 20.04.2 LTS (GNU/Linux 5.13.0-1036-oracle aarch64)

docker 容器 nginx:alpine 反代 8001 端口

nginx 配置如下

location / {
    proxy_set_header Host $host:$server_port;
    proxy_set_header X-Real-Ip $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass http://172.23.0.1:8001;
\}

#容器的 ip 信息
docker inspect nginx | grep IPAddress

"SecondaryIPAddresses": null,
            "IPAddress": "",
                    "IPAddress": "172.23.0.2",

nginx 内能够 ping 通 172.23.0.1 ，但是 wget http://172.23.0.1:8001 不行

应该要怎么配置才能够访问通

WenJimmy

2022-06-17 15:41:19 +08:00

@villivateur #1
docker 容器用的网卡名是 br-2db4a9812e19
......
-A FORWARD -o br-2db4a9812e19 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o br-2db4a9812e19 -j DOCKER
-A FORWARD -i br-2db4a9812e19 ! -o br-2db4a9812e19 -j ACCEPT
-A FORWARD -i br-2db4a9812e19 -o br-2db4a9812e19 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A OUTPUT -d 169.254.0.0/16 -j InstanceServices
-A DOCKER -d 172.23.0.2/32 ! -i br-2db4a9812e19 -o br-2db4a9812e19 -p tcp -m tcp --dport 443 -j ACCEPT
-A DOCKER -d 172.23.0.2/32 ! -i br-2db4a9812e19 -o br-2db4a9812e19 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -i br-2db4a9812e19 ! -o br-2db4a9812e19 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -o br-2db4a9812e19 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
........
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -s 172.23.0.0/16 ! -o br-2db4a9812e19 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE
-A POSTROUTING -s 172.23.0.2/32 -d 172.23.0.2/32 -p tcp -m tcp --dport 443 -j MASQUERADE
-A POSTROUTING -s 172.23.0.2/32 -d 172.23.0.2/32 -p tcp -m tcp --dport 80 -j MASQUERADE

-A DOCKER -i docker0 -j RETURN
-A DOCKER -i br-2db4a9812e19 -j RETURN
-A DOCKER ! -i br-2db4a9812e19 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.23.0.2:443
-A DOCKER ! -i br-2db4a9812e19 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.23.0.2:80

iptables 中相关的规则都在这了，看不太懂，我应该加什么配置才能过