使用“nginx-proxy”docker 容器配置的目标网站上出现错误网关错误

Question

我尝试使用出色的 nginx-proxy docker 容器在 latex.comnmodel.org 上的 vps 上解决 502 网关错误。我迷失在配置中，所以我将这个问题作为一个问题交叉发布到github，并在这里寻求帮助。

我的docker0 是172.17.0.1，docker -ps 命令返回：

CONTAINER ID        IMAGE                   COMMAND                  CREATED             STATUS              PORTS                                      NAMES
dca0d15c69bf        sharelatex/sharelatex   "/sbin/my_init"          2 minutes ago       Up 2 minutes        0.0.0.0:5000->80/tcp                       sharelatex
55ebd6b84a6a        osixia/phpldapadmin     "/container/tool/run"    3 days ago          Up 3 days           80/tcp, 443/tcp                            sleepy_thompson
e8fe2bd50c3a        osixia/openldap         "/container/tool/run"    3 days ago          Up 3 days           389/tcp, 636/tcp                           dreamy_babbage
9597ef0cded5        jwilder/nginx-proxy     "/app/docker-entrypoi"   3 days ago          Up 3 days           0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp   pensive_raman

我创建带有和不带有 VIRTUAL_PORT 选项的 sharelatex 图像：

sudo docker run -d -e "VIRTUAL_HOST=latex.comnmodel.org" -e "VIRTUAL_PORT=80" -v ~/sharelatex_data:/var/lib/sharelatex -p 5000:80 --name=sharelatex sharelatex/sharelatex

docker exec pensive_raman grep -vE '^\s*$' /etc/nginx/conf.d/default.conf 返回

# If we receive X-Forwarded-Proto, pass it through; otherwise, pass along the
# scheme used to connect to this server
map $http_x_forwarded_proto $proxy_x_forwarded_proto {
  default $http_x_forwarded_proto;
  ''      $scheme;
}
# If we receive Upgrade, set Connection to "upgrade"; otherwise, delete any
# Connection header that may have been passed to this server
map $http_upgrade $proxy_connection {
  default upgrade;
  '' close;
}
gzip_types text/plain text/css application/javascript application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript;
log_format vhost '$host $remote_addr - $remote_user [$time_local] '
                 '"$request" $status $body_bytes_sent '
                 '"$http_referer" "$http_user_agent"';
access_log off;
# HTTP 1.1 support
proxy_http_version 1.1;
proxy_buffering off;
proxy_set_header Host $http_host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $proxy_connection;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;
server {
        server_name _; # This is just an invalid value which will never trigger on a real hostname.
        listen 80;
        access_log /var/log/nginx/access.log vhost;
        return 503;
}
upstream latex.comnmodel.org {
                        # sharelatex
                        server 172.17.0.5:80;
}
server {
        server_name latex.comnmodel.org;
        listen 80 ;
        access_log /var/log/nginx/access.log vhost;
        location / {
                proxy_pass http://latex.comnmodel.org;
        }
}
upstream ldap.comnmodel.org {
                        # sleepy_thompson
                        server 172.17.0.4:80;
}
server {
        server_name ldap.comnmodel.org;
        listen 80 ;
        access_log /var/log/nginx/access.log vhost;
        location / {
                proxy_pass http://ldap.comnmodel.org;
        }
}

当我 ping latex.comnmodel.org 位于我的 vps ip 51.255.47.40 上时：

PING latex.comnmodel.org (51.255.47.40) 56(84) bytes of data.
64 bytes from 40.ip-51-255-47.eu (51.255.47.40): icmp_seq=1 ttl=50 time=14.6 ms
64 bytes from 40.ip-51-255-47.eu (51.255.47.40): icmp_seq=2 ttl=50 time=12.9 ms
64 bytes from 40.ip-51-255-47.eu (51.255.47.40): icmp_seq=3 ttl=50 time=13.6 ms

docker logs pensive_raman 返回

nginx.1    | latex.comnmodel.org 81.64.146.124 - - [22/Nov/2015:22:40:23 +0000] "GET / HTTP/1.1" 502 181 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0"
nginx.1    | latex.comnmodel.org 81.64.146.124 - - [22/Nov/2015:22:40:26 +0000] "GET / HTTP/1.1" 502 181 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0"
nginx.1    | latex.comnmodel.org 81.64.146.124 - - [22/Nov/2015:22:40:32 +0000] "GET / HTTP/1.1" 502 181 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:42.0) Gecko/20100101 Firefox/42.0"

我尝试连接到pensive_raman（nginx-proxy 镜像的名称）并ping 共享乳胶容器172.0.17.5，但没有成功，是我的网络配置有问题吗？

• 我需要使用docker run的--link选项来连接nginx-proxy容器和sharelatex容器吗？

• 我在0.0.0.0 上有两个 80 端口，这可能是问题所在，我在运行 sharelatex 映像时需要精确一个 ip 172.17.0.5 吗？这不干净

网站latex.comnmodel.org 回一个502 bad gateway，我在这里错过了什么，这很令人沮丧:(

更新 1：

Documentation 表示如果--icc = false，命令sudo iptables -L -n 命令包含删除规则。看来情况并非如此，因此 icc 选项采用默认的 true 值。

Chain INPUT (policy ACCEPT)
target     prot opt source               destination
f2b-sshd   tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 22

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain DOCKER (1 references)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            172.17.0.2           tcp dpt:443
ACCEPT     tcp  --  0.0.0.0/0            172.17.0.2           tcp dpt:80
ACCEPT     tcp  --  0.0.0.0/0            172.17.0.5           tcp dpt:80

Chain f2b-sshd (1 references)
target     prot opt source               destination
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

Answer 1

检查您是否正在使用--icc=false（容器间通信）运行docker daemon