I am trying to host the most basic python flask server over the linux container on ChromeOS.
The flask server hosts no problem, i have more of a problem with accessing it.
The thing is that the linux container runs over, by my understanding a private network with the ip 100.115.x.x
Hosting the flask server over this ip is working but somewhat obviously, not accessible over other devices over the network but how do i give it a accessible ip so that the server is accessible by it.
The ip ad command gives following output
5: eth0#if6: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 00:16:3e:88:24:7c brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 100.115.92.195/28 brd 100.115.92.207 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::216:3eff:fe88:247c/64 scope link
valid_lft forever preferred_lft forever
So the solution was quite simple and i was apparently just using the wrong questions for my research.
For those having the same problem and not knowing how to solve it, here is my solution:
In the developer section of the advanced settings you go to port forewarding and port foreward port 5000, which is the standard port for your flask app.
The you run the script under the ip of your linux container and can access it over the ip of your chromebook
So in the shell you would get displayed that the server runs on
http://100.115.92.195:5000
but you would use
http://192.168.60.70:5000
for example. Use whatever is displayed to be the ip of the chromebook.
Related
Trying to run QuakeJS within the docker container. I'm new to docker (and networking). Couldn't connect. Decided to start easier and ran nginxdemos/helloworld. Still can't connect to the server (running Ubuntu Server).
Tried:
docker run -d -p 8080:80 nginxdemos/hello
Probably relevant ip addr:
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 18:03:73:be:70:eb brd ff:ff:ff:ff:ff:ff
altname enp0s25
inet 10.89.233.61/20 metric 100 brd 10.89.239.255 scope global dynamic eno1
valid_lft 27400sec preferred_lft 27400sec
inet6 fe80::1a03:73ff:febe:70eb/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:ac:7c:bb:47 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:acff:fe7c:bb47/64 scope link
valid_lft forever preferred_lft forever
Here's docker-network-ls:
NETWORK ID NAME DRIVER SCOPE
5671ad4b57fe bridge bridge local
a9348e40fb3c host host local
fdb16382afbd none null local
ufw-status
To Action From
-- ------ ----
8080 ALLOW Anywhere
8080 (v6) ALLOW Anywhere (v6)
Anywhere ALLOW OUT 172.17.0.0/16 on docker0
But when I try to access in a web browser (chrome and firefox) at 172.17.0.0:8080 (or many other permutations) I just end up in a time out. I'm sure this is a stupid think but I'm very stuck.
UPDATE
I installed a basic apache server and it worked fine. So it's something with Docker. I think.
UPDATE AGAIN
docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES a7bbfee83954 nginxdemos/hello "/docker-entrypoint.…" About an hour ago Up About an hour 0.0.0.0:8080->80/tcp, :::8080->80/tcp relaxed_morse
I can use curl localhost:8080 and see the nginx page
I was playing with ufw but disabled it, not worried about network security. Tried ufw-docker too
FINAL UPDATE
Restarting Docker worked :|
When you publish a port with the -p option to docker run, the syntax is -p <host port>:<container port>, and you are saying, "expose the service running in the container on port <container port> on the Docker host as port <host port>.".
So when you run:
docker run -d -p 8080:80 nginxdemos/hello
You could open a browser on your host and connect to http://localhost:8080 (because port 8080 is the <host_port>). If you have the address of the container, you could also connect to http://<container_ip>:80, but you almost never want to do that, because every time you start a new container it receives a new ip address.
We publish ports to the host so that we don't need to muck about finding container ip address.
running 172.17.0.0:8080 (0.1, 0.2) or 10.89.233.61:8080 result in a timeout
172.17.0.0:8080 doesn't make any sense.
Both 172.17.0.1:8080 and 10.89.233.61:8080 ought to work (as should any other address assigned to a host interface). Some diagnostics to try:
Is the container actually running (docker ps)?
On the docker host are you able to connect to localhost:8080?
It looks like you're using UFW. Have you made any recent changes to the firewall?
If you restart docker (systemctl restart docker), do you see any changes in behavior?
On a KVM guest of my RHEL8 host, whose KVM guest is running CentOS7, I was expecting firewalld to by default block outside access to an ephemeral port published to by a Docker Container running nginx. To my surprise the access ISN'T blocked.
Again, the host (myhost) is running RHEL8, and it has a KVM guest (myguest) running CentOS7.
The firewalld configuration on myguest is standard, nothin' fancy:
[root#myguest ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0 eth1
sources:
services: http https ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
Here are the eth0 and eth1 interfaces that fall under the firewalld public zone:
[root#myguest ~]# ip a s dev eth0
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 52:54:00:96:9c:fc brd ff:ff:ff:ff:ff:ff
inet 192.168.100.111/24 brd 192.168.100.255 scope global noprefixroute eth0
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fe96:9cfc/64 scope link noprefixroute
valid_lft forever preferred_lft forever
[root#myguest ~]# ip a s dev eth1
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 52:54:00:66:6c:a1 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.111/24 brd 192.168.1.255 scope global noprefixroute eth1
valid_lft forever preferred_lft forever
inet6 fe80::5054:ff:fe66:6ca1/64 scope link noprefixroute
valid_lft forever preferred_lft forever
On myguest I'm running Docker, and the nginx container is publishing its Port 80 to an ephemeral port:
[me#myguest ~]$ docker container ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
06471204f091 nginx "/docker-entrypoint.…" About an hour ago Up About an hour 0.0.0.0:49154->80/tcp focused_robinson
Notice that in the prior firewall-cmd output I was not permitting access via this ephemeral TCP Port 49154 (or to any other ephemeral ports for that matter). So, I was expecting that unless I did so, outside access to nginx would be blocked. But to my surprise, from another host in the home network running Windows, I was able to access it:
C:\Users\me>curl http://myguest:49154
<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
.
.etc etc
If a container publishes its container port to an ephemeral one on the host (myguest in this case), shouldn't the host firewall utility protect access to that port in the same manner as it would a standard port? Am I missing something?
But I also noticed that in fact the nginx container is listening on a TCP6 socket:
[root#myguest ~]# netstat -tlpan | grep 49154
tcp6 0 0 :::49154 :::* LISTEN 23231/docker-proxy
It seems, then, that firewalld may not be blocking tcp6 sockets? I'm confused.
This is obviously not a production issue, nor something to lose sleep over. I'd just like to make sense of it. Thanks.
The integration between docker and firewalld has changed over the years, but based on your OS versions and CLI output I think you can get the behavior you expect by setting AllowZoneDrifting=no it /etc/firewalld/firewalld.conf 1 on the RHEL-8 host.
Due to zone drifting, it possible for packets received in a zone with --set-target=default (e.g. public zone) to drift to a zone with --set-target=accept (e.g. trusted zone). This means FORWARDed packets received in zone public will be forwarded to zone trusted. If your docker containers are using a real bridge interface, then this issue may apply to your setup. Docker defaults to SNAT so usually this problem is hidden.
Newer firewalld 2 releases have completely removed this behavior, because as you have found it's both unexpected and a security issue.
I create a go script who switch between IP linked to my eno1 interface.
In case my program perform a curl --interface "51.15.xx.xx" ... and switch between my 3 IPs
Bellow my interface :
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
link/ether ac:1f:6b:27:xx:xx brd ff:ff:ff:ff:ff:ff
inet 51.15.xx.xx/24 brd 51.15.21.255 scope global eno1
valid_lft forever preferred_lft forever
inet 212.83.xx.x1/24 brd 212.83.154.255 scope global eno1
valid_lft forever preferred_lft forever
inet 212.83.xx.x2/24 brd 212.83.154.255 scope global secondary eno1
valid_lft forever preferred_lft forever
My program run perfectly when he run on host directly, he work too on
docker run --network=host.
But in production with a docker swarm (deployed on 1 node), i can't bind host network and my program can't run. I get the error: bind failed with errno 99: Address not available
I just want to bind host network with local scope on a swarm service or allow my swarm service to bind host ip
PS: I already try to bind network host but when I execute docker stack deploy, docker select a host network with scope swarm.
Best regards
Did you publish a port when declaring your swarm service or stack ?
According to the documentation:
If your container or service publishes no ports, host networking has no effect.
See https://docs.docker.com/network/host/
Try to use a direct command to create service, for example:
Code
docker service create --network host caa06d9c/echo
Docker image does not expose any ports
Check
curl localhost:8080
Output
{
"method": "GET",
"path": "/",
"ip": "127.0.0.1"
}
So port attached to the host and can be accessed from any interfaces.
When I try to do ./stack.sh after the call trace I am provide with the following error :
`[Call Trace]
./stack.sh:217:source
/home/work/devstack/stackrc:821:die
[ERROR] /home/suramya/devstack/stackrc:821 Could not determine host ip address. See local.conf for suggestions on setting HOST_IP.
`
After cloning:
cd devstack/
cp samples/local.conf .
Edit the local.conf by adding the setting the HOST_IP of your machine on which devstack is being installed.
Add HOST_IP=<your machine ip address> to local.conf file.
STEPS:
List item Go to the root folder where you cloned or copied "devstack". Like /opt/stack/devstack
Edit the "local.conf file. vi local.conf
Add HOST_IP=0.0.0.0 (replace 0.0.0.0 with your machine IP address) to the file. Save and exit. The complete file will look like this:
[[local|localrc]]
HOST_IP=13.84.214.151
ADMIN_PASSWORD=secret
DATABASE_PASSWORD=$ADMIN_PASSWORD
RABBIT_PASSWORD=$ADMIN_PASSWORD
SERVICE_PASSWORD=$ADMIN_PASSWORD
Run ./stack.sh
This should run without errors.
First, get the IP address using the command:
ip addr show
Second, after you could get the IP address, copy and paste it in the local.conf file that you have created under the devstack directory, that should be looking like this:
[[local|localrc]]
HOST_IP=0.0.0.0 #replace 0.0.0.0 with your ip
ADMIN_PASSWORD=secret
DATABASE_PASSWORD=$ADMIN_PASSWORD
RABBIT_PASSWORD=$ADMIN_PASSWORD
SERVICE_PASSWORD=$ADMIN_PASSWORD
then run ./stack.sh again.
Edit this file "/opt/stack/devstack/stackrc"
In this file, find the HOST_IP Variable and change it to HOST_IP=0.0.0.0
Instead of 0.0.0.0, set your IP Address (ifconfig)
First check the IP address of your server interface by using command ifconfig.
Then find the line
HOST_IP=$(get_default_host_ip "$FIXED_RANGE" "$FLOATING_RANGE" "$HOST_IP_IFACE" "$HOST_IP" "inet") in the file /opt/stack/devstack/stackrc.
Put your server IP (in my setup line number is 859), make sure the entry is like below:
if [ "$HOST_IP" == "192.168.0.0" ];
then save the file (suppose my server IPis 192.168.0.0).
Run ./stack.sh
It works for me.
You don't have to set up the HOST_IP. It would be great if you can share your local.conf file for us to take a further look.
Take a look at this: https://docs.openstack.org/devstack/latest/
And there is a sample local.conf file under /samples
Find the IP Address
Add HOST_IP=[IP_ADDRESS]
Make sure there is no space between the '=' and IP address in step 2.
What I did is to modify stackrc and set
HOST_IP=${HOST_IP:-192.168.227.1}
192.168.227.1 is my IP, use your IP instead.
On Ubuntu 22.04, following the devstack tutorial here: https://docs.openstack.org/devstack/latest/
one only has this in local.conf :
[[local|localrc]]
ADMIN_PASSWORD=secret
DATABASE_PASSWORD=$ADMIN_PASSWORD
RABBIT_PASSWORD=$ADMIN_PASSWORD
SERVICE_PASSWORD=$ADMIN_PASSWORD
In the VM I run ./stack.sh in, I determined the IP from a shell:
ubuntu#ubuntu-Standard-PC-Q35-ICH9-2009:~/develop/devstack$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
link/ether 52:54:00:e5:00:fb brd ff:ff:ff:ff:ff:ff
inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute enp1s0
valid_lft 85917sec preferred_lft 85917sec
inet6 fec0::dd5:3efa:4caf:756b/64 scope site temporary dynamic
valid_lft 86043sec preferred_lft 14043sec
inet6 fec0::e0d0:2dd7:984b:e9a6/64 scope site dynamic mngtmpaddr noprefixroute
valid_lft 86043sec preferred_lft 14043sec
inet6 fe80::824d:ebd2:b04b:73ff/64 scope link noprefixroute
valid_lft forever preferred_lft forever
The IP is 10.0.2.15.
I simply added that as the HOST_IP so local.conf looks like:
ubuntu#ubuntu-Standard-PC-Q35-ICH9-2009:~/develop/devstack$ cat local.conf
[[local|localrc]]
ADMIN_PASSWORD=secret
DATABASE_PASSWORD=$ADMIN_PASSWORD
RABBIT_PASSWORD=$ADMIN_PASSWORD
SERVICE_PASSWORD=$ADMIN_PASSWORD
HOST_IP=10.0.2.15
Then run the command again and it passes the step.
I am using docker to run my web app on my local machine and I have created mocked web service using SoapUI on host machine.
The mocked service is accessible through localhost:8099 and IP 127.0.0.1:8099 (using telnet), I am however unable to access it from running docker container.
I have read some articles about discovering host IP address through
ip addr show docker0
with results:
5: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:e3:36:43:5b brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:e3ff:fe36:435b/64 scope link
valid_lft forever preferred_lft forever
When I tried to ping IP 172.17.0.1 from docker container I am getting responses just OK, but when trying to call the mocked web service from my web app I get responses No route to host.
I have also tried to modify iptables using iptables -A INPUT -i docker0 -j ACCEPT but with no success.
Is there any other setting that I am missing?
Any help is appreciated.
Thanks, shimon
If I have read your question right your local and host machines are not the same machine. In which case you won't be able to (unless you have set a tunnel up on localhost:8099) be able to access your mocker service on the host machine using localhost as it will resolve to your local ip (on your local machine).
What you need to do is make sure both machines can talk to each other and use the host machines IP instead of localhost.