I have started a docker container using the command
sudo docker run -it -P -d plcdimage
The image is built using a Dockerfile which has instruction EXPOSE 8080. Container runs a jboss server with an application deployed on it. Port mappings are :
Command: sudo docker port be1837e849dc
Output: 8080/tcp -> 0.0.0.0:32771
When I try to access the web application running on jboss in the container from the mapped host port using url:
http://IPAddressOfHost:32771/
I get connection refused error. Following is the result of command "netstat -tulpn"
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp6 0 0 :::9999 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 :::32771 :::* LISTEN -
udp 0 0 0.0.0.0:68 0.0.0.0:* -
I tried doing telnet hostip 32771 and it also results in connection refused.
Docker version 1.12.1
build 23cf638
What could be the possible reason for this?
Thanks in advance
I found that jboss server running inside the container was not listening on 0.0.0.0. One option to do this is, while starting the standalone server use -b 0.0.0.0.
/bin/standalone.sh -b 0.0.0.0
Related
Trying to use jupyter-notebook on a docker image (https://hub.docker.com/r/tensorflow/tensorflow), but having problem where using the port-forwarded address in browser just hangs with the (chrome) home page stuck saying Waiting for 127.0.0... until it just times out.
The docker command being run looks like
➜ ~ docker run -it -p 8888:8888 --rm tensorflow/tensorflow:latest-devel-gpu-py3 jupyter-notebook --ip 0.0.0.0 --no-browser --allow-root
[I 04:26:44.023 NotebookApp] Writing notebook server cookie secret to /root/.local/share/jupyter/runtime/notebook_cookie_secret
[I 04:26:44.042 NotebookApp] Serving notebooks from local directory: /root
[I 04:26:44.043 NotebookApp] The Jupyter Notebook is running at:
[I 04:26:44.043 NotebookApp] http://(f1afd4b163fd or 127.0.0.1):8888/?token=5a838cefbd58822ce3de5a9ab00ed724bc6f9e048017125a
[I 04:26:44.043 NotebookApp] Use Control-C to stop this server and shut down all kernels (twice to skip confirmation).
[C 04:26:44.043 NotebookApp]
Copy/paste this URL into your browser when you connect for the first time,
to login with a token:
http://(f1afd4b163fd or 127.0.0.1):8888/?token=5a838cefbd58822ce3de5a9ab00ed724bc6f9e048017125a
(note, have also tried docker run -it -p 8888:8888 --rm tensorflow/tensorflow:latest-devel-gpu-py3 /run_jupyter.sh --allow-root to similar hanging results).
Checking docker ps shows
➜ ~ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
2114609d6d9d tensorflow/tensorflow:latest-devel-gpu-py3 "jupyter-notebook --…" About a minute ago Up About a minute 6006/tcp, 0.0.0.0:8888->8888/tcp mystifying_liskov
Checking for a response via curl shows
➜ ~ curl -v http://127.0.0.1:8888/?token=5a838cefbd58822ce3de5a9ab00ed724bc6f9e048017125a
* Trying 127.0.0.1...
* Connected to 127.0.0.1 (127.0.0.1) port 8888 (#0)
> GET /?token=5a838cefbd58822ce3de5a9ab00ed724bc6f9e048017125a HTTP/1.1
> Host: 127.0.0.1:8888
> User-Agent: curl/7.47.0
> Accept: */*
>
<at this point just hangs until I ctl+C out>
* Recv failure: Connection reset by peer
* Closing connection 0
curl: (56) Recv failure: Connection reset by peer
and examine the ports shows
➜ ~ sudo netstat -plnt
[sudo] password for me:
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1512/sshd
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 2485/cupsd
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 2284/smbd
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1502/mysqld
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 2284/smbd
tcp 0 0 127.0.0.1:5037 0.0.0.0:* LISTEN 8558/adb
tcp 0 0 127.0.0.1:6000 0.0.0.0:* LISTEN 1006/unicorn.rb --h
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 1954/monitorix-http
tcp6 0 0 :::22 :::* LISTEN 1512/sshd
tcp6 0 0 ::1:631 :::* LISTEN 2485/cupsd
tcp6 0 0 :::445 :::* LISTEN 2284/smbd
tcp6 0 0 :::8888 :::* LISTEN 32491/docker-proxy
tcp6 0 0 :::139 :::* LISTEN 2284/smbd
tcp6 0 0 :::80 :::* LISTEN 1846/apache2
Other post I've seen seem to be people simply not forwarding the port that jupyter expects to use, but that does not seem to be the problem here. This occurs regardless of what docker image is used (so not just that particular image). If anyone has any ideas of what it could be or any debugging advice it would be appreciated.
Resolved the problem.
Restarted the host machine (note, this was the first time restarting since installing docker, but still did not work until...)
Ran sudo /etc/init.d/docker restart (Did this purely based on a hunch when skimming the troubleshooting docs here: https://docs.docker.com/toolbox/faqs/troubleshoot/#configure-http-proxy-settings-on-docker-machines).
Then the docker run ... statement from the posted question worked and can now reach the forwarded port on host machine and can curl the address. An Ubuntu notification popped up saying "Wired connection established".
This is a bit of a lame answer, but it's what worked for me. Oddly, seems have to rerun the sudo /etc/init.d/docker restart statement sometimes to get docker containers to open. Will try to figure out a bit more about what exactly was going on here, but if anyone with more experience thinks they know what may have been happening, please do let us know.
I start a container on machine whose IP address is 47.foo.bar.bazz:
docker run -it -p 8888:8888 continuumio/miniconda3
And inside the container ,8888port is opened by a flask application:
python manage.py runserver -h 0.0.0.0 -p 8888
I can send http request to this port successfully by
curl "http://127.0.0.1:8888/api/v1/vocabulary?callback=zoo
But when I use it's IP it doesn't work, and I can't access it from remote machine either
curl "http://47.foo.bar.bazz:8888/api/v1/vocabulary?callback=zoo
Here is some information:
netstat -aptn
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp6 0 0 :::80 :::* LISTEN 9211/docker-proxy
tcp6 0 0 :::8888 :::* LISTEN 28811/docker-proxy
tcp6 0 0 :::443 :::* LISTEN 9194/docker-proxy
Btw,I can curl the 80 port successfully using the IP address.
Could anyone please point out what's wrong?How can I access it successfully from remote machine?
I figured out here. Maybe the port is blocked. On the other hand,I used nginx to forward my request form 80 to 8888.
Im trying configure the docker daemon so i can connect to it from inside the docker containers i start..
So i changed /etc/docker/daemon.json to
{
"hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"]
}
So that i connect to it through the docker bridge.. However when i restart docker i get
netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address
State PID/Program name
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 3728/mysqld
tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN 24253/redis-server
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 3756/nginx
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 3634/sshd
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 3756/nginx
tcp6 0 0 :::8010 :::* LISTEN 4230/apache2
tcp6 0 0 :::9200 :::* LISTEN 26824/java
tcp6 0 0 :::9300 :::* LISTEN 26824/java
tcp6 0 0 :::22 :::* LISTEN 3634/sshd
tcp6 0 0 :::2375 :::* LISTEN 1955/dockerd
So first i though the issue was the fact that it was listening on ipv6 not ipv4. and according to
Make docker use IPv4 for port binding
It should all still work but it doesnt.. When i try
telnet 172.17.0.1(docker host) 2375
it fails to connect while
telnet 172.17.0.1(docker host) 80
works. How can i connect to docker running on the host machine? Im running on Ubuntu 14.04.5 docker Version: 17.06.2-ce
You can start your containers mounting the host docker socket into your containers.
docker run -v /var/run/docker.sock:/var/run/docker.sock ...
With this setup, Docker clients inside the containers will be using the Docker daemon from the host. Your containers will be able to build, run, push etc. using daemon running in host. Please note that with these setup everything is happening on the host, so if you start new containers they will be “sibling” containers.
EDIT
If you are using the bridge network, you can connect to any service running on host machine using host IP address.
For example, I have mysqld running on my host with IP 10.0.0.1 and from a container I can do
mysql -u user -p -h 10.0.0.1
The trick is to find out the host IP address from containers.
In Docker for Mac (I am running version 17.07.0) is as simple as connecting to the special host "docker.for.mac.localhost"
Another option is to add an alias IP to your loopback interface
sudo ifconfig lo0 alias 192.168.1.1
And then when running containers add a host for this alias IP
docker run --rm -ti --add-host host-machine:192.168.1.1 mysql:5.7 bash
With this setup, inside container you should be able to do
mysql -u user -p -h host-machine
This answer may be a bit late, but it's better late than never as we never can tell who may be experiencing similar problem. I just fixed it be disabling the unnecessary ufw rule blocking the internal communication.
Example:
sudo ufw allow from <IP address or range> to any port [desired port]
sudo ufw allow from 172.16.0.0/12 to any port 3421.
As for me, I disabled the UFW service totally using the command below.
sudo ufw disable
I made 2 docker image( nginx, yeoman) and mapped port as below.
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
3a71ee900cc0 webserver:0.1 "nginx" About an hour ago Up About an hour 443/tcp, 0.0.0.0:8080->80/tcp webserver
af57b93ca326 silarsis/yeoman "/bin/bash" About an hour ago Up About an hour 0.0.0.0:9000->9000/tcp yeoman
And get into yeoman docker to make grunt server.
yeoman_docker$ yo ..scafolding stuff
yeoman_docker$ ls
Gruntfile.js README.md app bower.json bower_components node_modules package.json test
yeoman_docker$ grunt serve
Running "serve" task
Done, without errors.
Execution Time (2016-09-23 07:20:28 UTC-0)
loading tasks 5ms ▇▇▇▇▇▇▇ 19%
loading grunt-contrib-copy 13ms ▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇ 50%
copy:styles 8ms ▇▇▇▇▇▇▇▇▇▇▇ 31%
Total 26ms
Running "autoprefixer:server" (autoprefixer) task Autoprefixer's process() method is deprecated and will removed in next major release. Use postcss([autoprefixer]).process() instead File .tmp/styles/main.css created.
Running "connect:livereload" (connect) task Started connect web server on http://localhost:9000
Running "watch" task Waiting...
Keep this SSH to maintain grunt serve.
Nginx is accessable from local (127.0.0.1:8080) But grunt is not able to access(127.0.0.1:9000). Is there any difference between making grunt server in local and docker? What should I do with it?
It seems that grunt server is not on local.
$ telnet 127.0.0.1 9000
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Connection closed by foreign host.
$ netstat -ant
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 10.0.8.1:53 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp6 0 0 :::9000 :::* LISTEN
tcp6 0 0 :::8080 :::* LISTEN
tcp6 0 0 :::21 :::* LISTEN
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 127.0.0.1:9000 127.0.0.1:39682 TIME_WAIT
The issue is that your connect server in the yeoman container listens to localhost inside the container:
Running "connect:livereload" (connect) task Started connect web server on http://localhost:9000
When creating a port binding with docker the service inside the docker container has to listen to host 0.0.0.0, not localhost. You need to update your gruntfile.js so that you connect server listens to 0.0.0.0.
I am trying to run a Docker image from inside Google Cloud Shell (i.e. on an courtesy Google Compute Engine instance) as follows:
docker run -d -p 20000-30000:10000-20000 -it <image-id> bash -c bash
Previous to this step, netstat -tuapn has reported the following:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:8998 0.0.0.0:* LISTEN 249/python
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:13080 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:13081 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:34490 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:13082 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:13083 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:13084 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:34490 127.0.0.1:48161 ESTABLISHED -
tcp 0 252 172.17.0.2:22 173.194.92.34:49424 ESTABLISHED -
tcp 0 0 127.0.0.1:48161 127.0.0.1:34490 ESTABLISHED 15784/python
tcp6 0 0 :::22 :::* LISTEN -
So it looks to me as if all the ports between 20000 and 30000 are available, but the run is nevertheless terminated with the following error message:
Error response from daemon: Cannot start container :
failed to create endpoint on network bridge: Timed out
proxy starting the userland proxy
What's going on here? How can I obtain more diagnostic information and ultimately solve the problem (i.e. get my Docker image to run with the whole port range available).
Opening up ports in a range doesn't currently scale well in Docker. The above will result in 10,000 docker-proxy processes being spawned to support each port, including all the file descriptors needed to support all those processes, plus a long list of firewall rules being added. At some point, you'll hit a resource limit on either file descriptors or processes. See issue 11185 on github for more details.
The only workaround when running on a host you control is to not allocate the ports and manually update the firewall rules. Not sure that's even an option with GCE. Best solution will be to redesign your requirements to keep the port range small. The last option is to bypass the bridge network entirely and run on the host network where there are no more proxies and firewall rules with --net=host. The later removes any network isolation you have in the container, so tends to be recommended against.