Running firewalld in a docker container - docker

I am struggling installing filemaker server inside docker 20.10.18 container, it seems to be failing to setup firewalld:
ERROR:dbus.proxies:Introspect error on :1.9:/org/fedoraproject/FirewallD1/config:
dbus.exceptions.DBusException: org.freedesktop.DBus.Error.NoReply: Message recipient
disconnected from message bus without replying
Error: The name :1.9 was not provided by any .service files
Open HTTP connection port 80...
Open HTTPS connection port 443...
Open ODBC connection port 2399...
Open Claris FileMaker Server primary machine connection port 5003...
FirewallD is not running
I tried to install and run firewalld manually but failed as well. Tried the following advised by the docker documentation, but still no luck:
firewall-cmd --zone=trusted --remove-interface=docker0 --permanent
firewall-cmd --reload
I use:
Linux Ubuntu version: 20.04.2
Filemaker server: 19.5.3
Docker version: 20.10.18
Linux Ubuntu I run through a virtual machine
I will appreciate any hint.
Thanks.

The Dockerfile in this document should work.
Please follow the instructions in this link.

Related

How-To: Access local minikube cluster, with kubectl running inside VSCode Development Container?

I have minikube cluster running on Windows WSL2, and I have a Dev Container https://code.visualstudio.com/docs/remote/create-dev-container) running my React Application and Kubernetes CLI tools. My goal is to containerize the application and run that on the minikube cluster.
So now I have exposed the local configurations and certifications of minikube to my Dev Container, and I am using that as a default KUBECONFIG. I have a deployment, and Docker Image ready - so next step is to try to use deployment and have that running on the cluster.
When I am running a kubectl command inside the Dev Container, I am getting error message like this:
The connection to the server 127.0.0.1:51515 was refused - did you specify the right host or port?
When I am inspecting the minikube container, I see that its listening only to localhost
gcr.io/k8s-minikube/kicbase:v0.0.28 "/usr/local/bin/entr…" 3 hours ago Up 3 hours 127.0.0.1:58892->22/tcp, 127.0.0.1:58893->2376/tcp, 127.0.0.1:58895->5000/tcp, 127.0.0.1:58896->8443/tcp, 127.0.0.1:58894->32443/tcp minikube
So as far as I know, these requests fail, because request from Dev Container is not considered as a localhost request (I am able to ping localhost.). I am running the Dev Container with network=host flag.
So atleast one way to get this setup working it to bind minikube's ports to listen to 0.0.0.0, instead of localhost - is there any other way? How could I get that 0.0.0.0 bind working? I am having a feeling that this could be Docker Desktop settings related - that I need to somehow change some kind of default settings from 127.0.0.1 -> 0.0.0.0.
Running minikube with this command didn't do the trick.
minikube start --driver=docker --listen-address='0.0.0.0'
Versions:
Docker Desktop 4.6.0 (75818)
Docker 20.10.13, build a224086
minikube v1.24.0
kubectl 1.21.5
Thank you in advance!
EDIT:
I also tried different alternatives to localhost, without changing the configuration in minikube, with the same port that is on host computer - these didn't do the trick. I can however ping every address from Container.
kubernetes.docker.internal, host.docker.internal, 192.168.49.2 (Minikube's IP on localhost), minikubeCA, control-plane.minikube.internal, kubernetes.default.svc.cluster.local, kubernetes.default.svc, kubernetes.default, kubernetes, localhost
Here is my minikube's KUBECONFIG.
- cluster:
certificate-authority-data: Removed for Security.
extensions:
- extension:
last-update: Mon, 28 Mar 2022 17:30:48 EEST
provider: minikube.sigs.k8s.io
version: v1.24.0
name: cluster_info
server: https://localhost:58896
name: minikube
I managed to solve this. Docker Desktop requires to use host.docker.internal instead of localhost inside Kubernetes Config YAML.
Problem is that first address is not allowed by Minikubes Certificate. Running kubectl commands with flag --insecure-skip-tls-verify - so for example
kubectl get nodes -A --insecure-skip-tls-verify
works, with setup defined above.
Found also some documentation: https://github.com/Microsoft/vscode-dev-containers/tree/main/containers/kubernetes-helm

FirewallD blocks inbound connections to Docker containers OpenSUSE Leap 15.3

I've got Nginx and a few other containers running under docker-compose.
I can access the web server from the host machine, but not from a remote one under port 80 and 443. Once I disable firewalld, I can access the Docker container, signifying this is a firewall issue. I've tried every single possible solution that people used for CentOS and Fedora, but they didn't work for me. Plus, I'm using Docker 20, so this shouldn't be a problem for me as there is a docker zone in firewalld that's supposed to configure everything.
My active zones:
docker
interfaces: docker0 br-5da83ae671bb br-7918f1f94df9
public
interfaces: br0 eth0
trusted
interfaces: tun0
sources: 10.0.0.0/24
The network I'm running the containers on is br-7918f1f94df9 which has ipv4 172.18.0.1/16
In general, does anyone have any commands for me to try to see if it gets fixed? Let me know if I need to include anything else.
Epilogue: Maybe I'm just pissed because I've been having this issue for the past two days now, but I think that SUSE is just a terrible distro for user-friendliness because I keep getting issues like this that seemingly have no fix. What's a better distribution in your opinion?
Remove the interface docker0 from being managed by firewalld
Check the docker documentation https://docs.docker.com/network/iptables/
Please substitute the appropriate zone and docker interface
firewall-cmd --zone=docker --remove-interface=docker0 --permanent
firewall-cmd --reload

Cent OS firewall Problem with Services (Jenkins and Apache Tomcat) deployed on servers

I have Deployed Jenkins On a Server. The Server runs a CentOS Linux 8 as Operating system. I Wanted to access the Jenkins from another Device (laptop/PC) which is already in same network. but firewall restricts me in doing this. whenever i disable firewall I'm able to access the Jenkins but disabling firewall isn't option for me what else can i do to resolve this problem.
Well you need to open the ports used by Jenkins in the Centos Firewall. As I understand Jenkins uses ports 8080 and 8443 by default. See this guide on how to open and close ports in Centos 8
You can open the ports used by Jenkins/Tomcat using this command:
firewall-cmd --perm --add-port=your-port/your-protocol for example, to open port 8080 in tcp use this
firewall-cmd --perm --add-port=8080/tcp
After doing that, you have to reload the FirewallD tables using:
firewall-cmd --reload
The --perm option makes your rule permanent upon reboot.

ELK containers are unable to connect on different nodes when firewall is running

I have a ELK docker swarm setup running across 4 different hosts. I am able to ping the containers which are on different host but when I try to run curl commands it is not connecting curl http://elastic:9200. Logstash and kibana applications are unable to connect to elasticsearch containers (3 node es cluster) which are on different hosts. I have opened all the ports mentioned in docker swarm documentation across all hosts https://docs.docker.com/engine/swarm/swarm-tutorial/#the-ip-address-of-the-manager-machine but no luck. After stopping firewall on all hosts, LS/Kibana are able to connect to elasticsearch.
Attempted to resurrect connection to dead ES instance, but got an error Unable to connect to Elasticsearch at http://es-proxy:9200/
Has anyone experienced this issue? Thanks.
I was able to resolve the issue by adding my docker network interface into a trusted zone.
https://success.docker.com/article/firewalld-problems-with-container-to-container-network-communications
Lastly, I added my docker subnet as a trusted source.
firewall-cmd --permanent --zone=trusted --add-source=subnet/range

"docker-machine create" gives connection attempt failed error when run from behind a corporate proxy

I am new to docker and am trying to create a docker host using the docker-machine create [name] command on Windows 7 but I always get a connection attempt failed error.
I added the HTTP_PROXY and HTTPS_PROXY to Docker Toolbox\start.sh but that did not help
Also tried :
--engine-env HTTP_PROXY=http://proxy IP:port CLI option for docker-machine create command
Windows powershell command $env:HTTP_PROXY=http://proxy IP:port to set the environment variable at global level
But none of these have resolved the issue.
docker-machine version and the error:
C:\Windows\system32> docker-machine -v
docker-machine.exe version 0.14.0, build 89b8332
C:\Windows\system32> docker-machine create node-1
(node-1) Unable to get the latest Boot2Docker ISO release version:
Get
https://api.github.com/repos/boot2docker/boot2docker/releases/latest:
dial tcp 192.30.253.116:443: connectex: A connection attempt failed
because the connected party did not properly respond after a period of
time, or established connection failed because connected host has
failed to respond.
Since there was no response to my query above I uninstalled docker toolbox and installed docker on a VM. It is working perfectly now. I have written an article on Medium for all you are trying this for the first time and need help in setting up Docker on Win7 behind a corporate proxy. The article can be found here : https://medium.com/#uvnikgupta/installing-docker-on-win7-pc-79db4217bbae

Resources