【问题标题】：Connection refused when connecting to the exposed port on docker container连接到 docker 容器上的暴露端口时连接被拒绝
【发布时间】：2019-10-18 16:10:58
【问题描述】：

Dockerfile 看起来像这样：

FROM ubuntu:latest
LABEL Spongebob Dockerpants "s.dockerpants@comcast.net"
RUN apt-get update -y
RUN apt-get install -y python3-pip python3-dev build-essential

#Add source files
COPY . /app
ENV HOME=/app
WORKDIR /app

# Install Python web server and dependencies
RUN pip3 install -r requirements.txt

ENV FLASK_APP=app.py

# Expose port
EXPOSE 8090
#ENTRYPOINT ["python3"]
CMD ["python3", "app.py"]
CMD tail -f /dev/null

我是这样启动容器的：

docker run --name taskman -p 8090:8090 -d task-manager-app:latest

我看到容器正在运行，并且我的 localhost 在 8090 上监听：

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ docker ps
CONTAINER ID        IMAGE                     COMMAND                  CREATED              STATUS              PORTS                    NAMES
c1ac5cb27698        task-manager-app:latest   "/bin/sh -c 'tail -f…"   About a minute ago   Up About a minute   0.0.0.0:8090->8090/tcp   taskman

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ sudo netstat -nlp | grep 8090
tcp6       0      0 :::8090                 :::*                    LISTEN      1154/docker-proxy

我尝试按照我发出的 docker run 命令通过 localhost 到达容器上的 8090，但得到“连接被拒绝”

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ curl http://localhost:8090
curl: (56) Recv failure: Connection reset by peer

然后我检查了端口绑定，它看起来没问题：

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ sudo docker port c1ac5cb27698 8090
0.0.0.0:8090

当我执行 docker inspect 时，我看到：

$ docker inspect c1ac5cb27698 | grep -A 55 "NetworkSettings"
        "NetworkSettings": {
            "Bridge": "",
            "SandboxID": "7c2249761e4f48eef373c6744161b0709f312863c94fdc17138913952be698a0",
            "HairpinMode": false,
            "LinkLocalIPv6Address": "",
            "LinkLocalIPv6PrefixLen": 0,
            "Ports": {
                "8090/tcp": [
                    {
                        "HostIp": "0.0.0.0",
                        "HostPort": "8090"
                    }
                ]
            },
            "SandboxKey": "/var/run/docker/netns/7c2249761e4f",
            "SecondaryIPAddresses": null,
            "SecondaryIPv6Addresses": null,
            "EndpointID": "ea7552d0ba9e8f0c865fa4a0f24781811c7332a1e7473c48e88fa4dbe6e5e05d",
            "Gateway": "172.17.0.1",
            "GlobalIPv6Address": "",
            "GlobalIPv6PrefixLen": 0,
            "IPAddress": "172.17.0.2",
            "IPPrefixLen": 16,
            "IPv6Gateway": "",
            "MacAddress": "02:42:ac:11:00:02",
            "Networks": {
                "bridge": {
                    "IPAMConfig": null,
                    "Links": null,
                    "Aliases": null,
                    "NetworkID": "cfb5be57fdeed8a08b1650b5706a00542c5249903ce33052ff3f0d3dab619675",
                    "EndpointID": "ea7552d0ba9e8f0c865fa4a0f24781811c7332a1e7473c48e88fa4dbe6e5e05d",
                    "Gateway": "172.17.0.1",
                    "IPAddress": "172.17.0.2",
                    "IPPrefixLen": 16,
                    "IPv6Gateway": "",
                    "GlobalIPv6Address": "",
                    "GlobalIPv6PrefixLen": 0,
                    "MacAddress": "02:42:ac:11:00:02",
                    "DriverOpts": null
                }
            }
        }
    }

我可以从本地主机 ping 容器：

CORP\n0118236 @ a-33jxiw0rv8is5 in ~/docker_pete/flask-task-manager on master*
$ ping 172.17.0.2
PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.
64 bytes from 172.17.0.2: icmp_seq=1 ttl=255 time=0.045 ms
64 bytes from 172.17.0.2: icmp_seq=2 ttl=255 time=0.042 ms
64 bytes from 172.17.0.2: icmp_seq=3 ttl=255 time=0.047 ms
^C
--- 172.17.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2053ms
rtt min/avg/max/mdev = 0.042/0.044/0.047/0.008 ms

配置中有什么会导致这些连接被拒绝吗？绑定有问题吗？

【问题讨论】：

一个容器只有一个命令，在 Dockerfile 中最后一个 CMD 获胜。您的图像实际上并未运行您的服务器；它正在运行“永远等待，什么也不做”的工作。

标签： linux docker flask dockerfile containers

【解决方案1】：

您的 docker 文件包含两个 CMD 行，但 docker 只会使用最新的。

CMD ["python3", "app.py"]
CMD tail -f /dev/null

在容器中执行的实际命令是 tail 命令，它不会绑定和侦听端口。您可以使用tail 命令 ping 容器，因为容器处于活动状态。

【讨论】：