如何允许访问EC2实例上的docker容器

Question

我有一个看起来像这样的构建过程：

1。代码被推送到由BitBucker Pipelines

选取的BitBucket

image: node:8.2.1
pipelines:
  default:
    - step:
        name: Push Server to AWS Repository
        script:
          - docker login -u AWS -p $AWS_ECR_LOGIN https://$AWS_ECR_URL
          - docker build -t dev .
          - docker tag dev:latest $AWS_ECR_URL/dev:latest
          - docker push $AWS_ECR_URL/dev:latest

options:
  docker: true

2。 BitBucket Pipelines从repo中的Dockerfile构建Docker镜像并将其推送到Amazon ECR

# BUILD DEV IMAGE and TEST
FROM node:8.2.1 as builder
COPY ./ /user/src/app
WORKDIR /user/src/app
RUN npm install -g grunt-cli --quiet
RUN npm install --quiet
RUN grunt build
# RUN npm test:build

# BUILD APP IMAGE
FROM node:8.2.1
COPY --from=builder /user/src/app/dist /user/src/app/
WORKDIR /user/src/app
RUN npm install -g mongodb-migrations --quiet
RUN npm install --only=prod --quiet
EXPOSE 5000
CMD npm start

3。 Jenkins工作在ECR中监视新映像并远程触发EC2实例以拉动并重新启动docker镜像

let dockerApi = new Docker({
    host: DockerIpAddress,
    port: process.env.DOCKER_PORT || 2375,
    version: 'v1.32' // required when Docker >= v1.13, https://docs.docker.com/engine/api/version-history/
});

dockerApi.createContainer({
    Image: IMAGE_NAME,
    AttachStdout: true,
    AttachStderr: true,
    Tty: true,
    Env: [`NODE_ENV=${ENV}`],
    ExposedPorts: {
        "5000/tcp": {},
    },
    HostConfig:{
        PortBindings: {
            "5000/tcp": [{
                "HostPort": "5000"
            }],
        },
    },
})

问题

到目前为止 - 一切正常！我的docker容器正在ec2实例上运行。什么不起作用是我无法接收任何联系。即使从ssh进入ec2实例，curl http://localhost:5000也无效。通过公共IP或公共主机从浏览器访问ec2实例也不起作用。

IP表

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination
DOCKER-ISOLATION  all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
DOCKER     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             ip-172-17-0-2.ec2.internal  tcp dpt:5000

Chain DOCKER-ISOLATION (1 references)
target     prot opt source               destination
RETURN     all  --  anywhere             anywhere

的sysctl

$ sysctl net.ipv4.conf.all.forwarding
net.ipv4.conf.all.forwarding = 1

Docker最后一行输出中的节点服务器

Server running at: http://localhost:5000

Answer 1

检查您用于创建映像的Dockerfile是否运行一个脚本，该服务器将服务器暴露在0.0.0.0而不是localhost中。

你应该打开0.0.0.0:5000->5000而不是在localhost中运行!!

希望这有帮助。