0

Other titles might be:

  • Docker doesn't set up port forwarding now.
  • After flushing the iptables and reinstalling Docker I have lost port forwarding.

I am having trouble accessing my Docker container from 127.0.0.1, Host IP, and anywhere else except for the Docker container on port 80.  I have also tried other ports and port 80 is not in use.

That is to say the Docker container's IP address returns the correct service on port 80, but it's not forwarded outside to the world.

Another thing to note this is an Ubuntu Server 19.04 build which I enabled Kubernetes (the snap mini K8 version) on at the start and have since done a number of things trying to fix the port forwarding. One of which is to completely uninstall Kubernetes and Docker from snap, delete all the iptables rules they left behind and set the iptables to allow all INPUT, OUTPUT and FORWARD.  I then reinstalled the snap version of Docker 18.06.1-ce stable from canonical.  I would like to figure out how to make snap work well with my build.

Here is my docker_compose.yml:

version: '3.7'

volumes:
  mysql:
    driver: local
  backup:
    driver: local
  redis:
    driver: local
  files:
    driver_opts:
      type: "nfs"
      o: "addr=192.168.1.81,nolock,soft,rw"
      device: ":/volume1/fileserver"


services:
  owncloud:
    image: owncloud:${OWNCLOUD_VERSION}
    restart: always
    ports:
      - ${HTTP_PORT}:8080
    depends_on:
      - db
      - redis
    environment:
      - OWNCLOUD_DOMAIN=${OWNCLOUD_DOMAIN}
      - OWNCLOUD_DB_TYPE=mysql
      - OWNCLOUD_DB_NAME=owncloud
      - OWNCLOUD_DB_USERNAME=owncloud
      - OWNCLOUD_DB_PASSWORD=owncloud
      - OWNCLOUD_DB_HOST=db
      - OWNCLOUD_ADMIN_USERNAME=${ADMIN_USERNAME}
      - OWNCLOUD_ADMIN_PASSWORD=${ADMIN_PASSWORD}
      - OWNCLOUD_MYSQL_UTF8MB4=true
      - OWNCLOUD_REDIS_ENABLED=true
      - OWNCLOUD_REDIS_HOST=redis
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - files:/mnt/data
    hostname: "extrahost1"
    extra_hosts:
      - "extrahost1:192.168.1.61"
      - "extrahost2:127.0.0.1"


  db:
    image: webhippie/mariadb:latest
    restart: always
    environment:
      - MARIADB_ROOT_PASSWORD=owncloud
      - MARIADB_USERNAME=owncloud
      - MARIADB_PASSWORD=owncloud
      - MARIADB_DATABASE=owncloud
      - MARIADB_MAX_ALLOWED_PACKET=128M
      - MARIADB_INNODB_LOG_FILE_SIZE=64M
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - mysql:/var/lib/mysql
      - backup:/var/lib/backup

  redis:
    image: webhippie/redis:latest
    restart: always
    environment:
      - REDIS_DATABASES=1
    healthcheck:
      test: ["CMD", "/usr/bin/healthcheck"]
      interval: 30s
      timeout: 10s
      retries: 5
    volumes:
      - redis:/var/lib/redis

My iptables output after installing and loading the containers.  It would seem that the isolation isn't allowing any traffic in or out.

iptables -L --line-numbers

Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    DOCKER-USER  all  --  anywhere             anywhere            
2    DOCKER-ISOLATION-STAGE-1  all  --  anywhere             anywhere            
3    ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
4    DOCKER     all  --  anywhere             anywhere            
5    ACCEPT     all  --  anywhere             anywhere            
6    ACCEPT     all  --  anywhere             anywhere            
7    ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
8    DOCKER     all  --  anywhere             anywhere            
9    ACCEPT     all  --  anywhere             anywhere            
10   ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Chain DOCKER (2 references)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  anywhere             172.18.0.4           tcp dpt:http-alt

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
num  target     prot opt source               destination         
1    DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
2    DOCKER-ISOLATION-STAGE-2  all  --  anywhere             anywhere            
3    RETURN     all  --  anywhere             anywhere            

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
num  target     prot opt source               destination         
1    DROP       all  --  anywhere             anywhere            
2    DROP       all  --  anywhere             anywhere            
3    RETURN     all  --  anywhere             anywhere            

Chain DOCKER-USER (1 references)
num  target     prot opt source               destination         
1    RETURN     all  --  anywhere             anywhere     

1 Answer 1

0

Interresting technical issue, i was searching solutions And i figure out the following information:

https://fralef.me/docker-and-iptables.html

The file explains that for some prestablished ip tables rules for docker container usage they have to be set as false to use the ones that docker use by default. Additionally there are some networking things that has to be checked to improve internet función, sometimes Network fáilures can cause not stable port forwarding functions. Perhaps that can help.

2
  • Thanks for your post. I think this will be a good start. I also came across that. I am working on a solution where I generate the IPtables. I think I there is a way use the Docker-User to open a port. I don't get it, in previous installations of docker on MacOS and CentOS, ports were automagically opened with the ports array.
    – mhsquire83
    Commented Jun 5, 2019 at 2:54
  • I found this! Looks promising although I haven't quite learned everything about it. medium.com/@ebuschini/iptables-and-docker-95e2496f0b45
    – mhsquire83
    Commented Jun 5, 2019 at 12:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .