docker ubuntu 容器中不允许端口答案

【问题标题】：Can't allow port in docker ubuntu containerdocker ubuntu 容器中不允许端口
【发布时间】：2019-07-05 09:24:42
【问题描述】：

想允许一个端口说 4000。冉：

root@66548e7316fc:/# sudo ufw allow 4000/tcp
WARN: initcaps
[Errno 2] iptables v1.6.1: can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.

Skipping adding existing rule
Skipping adding existing rule (v6)
root@66548e7316fc:/# 

root@66548e7316fc:/# sudo ufw status
ERROR: problem running iptables: iptables v1.6.1: can't initialize iptables table `filter': Permission denied (you must be root)
Perhaps iptables or your kernel needs to be upgraded.


root@66548e7316fc:/# service ufw status
 * Firewall is not running...                                                                  [fail] 
root@66548e7316fc:/# sudo ufw reload
Firewall not enabled (skipping reload)
root@94d82c9ba002:/# sudo ufw enable
ERROR: problem running ufw-init
/lib/ufw/ufw-init: 118: /lib/ufw/ufw-init: modprobe: not found
/lib/ufw/ufw-init: 118: /lib/ufw/ufw-init: modprobe: not found
/lib/ufw/ufw-init: 118: /lib/ufw/ufw-init: modprobe: not found
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 1
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 1
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 1
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 1
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 1
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 12
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 12
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 1
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 1
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
iptables-restore v1.6.1: iptables-restore: unable to initialize table 'filter'

Error occurred at line: 1
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
sysctl: setting key "net.ipv4.conf.all.accept_redirects": Read-only file system
sysctl: setting key "net.ipv4.conf.default.accept_redirects": Read-only file system
sysctl: setting key "net.ipv6.conf.all.accept_redirects": Read-only file system
sysctl: setting key "net.ipv6.conf.default.accept_redirects": Read-only file system
sysctl: setting key "net.ipv4.icmp_echo_ignore_broadcasts": Read-only file system
sysctl: setting key "net.ipv4.icmp_ignore_bogus_error_responses": Read-only file system
sysctl: setting key "net.ipv4.icmp_echo_ignore_all": Read-only file system
sysctl: setting key "net.ipv4.conf.all.log_martians": Read-only file system
sysctl: setting key "net.ipv4.conf.default.log_martians": Read-only file system

Problem loading ipv6 (skipping)
Problem running '/etc/ufw/before.rules'
Problem running '/etc/ufw/after.rules'
Problem running '/etc/ufw/user.rules'

root@94d82c9ba002:/# 
sudo ufw reload
Firewall not enabled (skipping reload)

正如您在上述命令提示符中看到的 root@66548e7316fc:/#，我已经是 root。

【问题讨论】：

您通常不能在 Docker 容器内更改防火墙设置，而且您通常根本不会从容器内配置网络。您是否正在尝试解决更高级别的问题？
实际上我正在手动测试 docker 容器内的东西（我的意思是手动尝试）

标签： docker ubuntu ufw

【解决方案1】：

要允许机器连接到容器的端口，您应该使用expose 或ports Docker 的属性。

EXPOSE 指令通知 Docker 容器在运行时侦听指定的网络端口。可以指定端口监听 TCP 还是 UDP，如果不指定协议则默认为 TCP。

来自 Docker 的documentation。

或者ports：

默认情况下，当您创建一个容器时，它不会向外界发布任何端口。要使端口可用于 Docker 外部的服务或未连接到容器网络的 Docker 容器，请使用 --publish 或 -p 标志。

来自here。

您还可以指定此端口将侦听的 IP 地址：

docker run -p 127.0.0.1:4000:4000 my container

【讨论】：

这就是要走的路。恕我直言，在 Docker 容器中运行 ufw 没有意义，因为您在启动容器的过程中已经指定了允许的端口。
实际上，我试图使用nc (netcat cli) 将一些数据从一个容器发送到另一个容器。但是发件人容器说connection refused。因此，如果可行，我正在尝试防火墙以允许使用来自接收方站点的ufw cmd 的端口。这就是我的情况。很抱歉没有说明整个故事，因为我认为没有必要在 que 描述中说明这一点。