我将我的容器的docker端口暴露给主机
docker run -p 80:80 ...
然后我尝试显示所有监听端口以进行调试,netstat例如:
netstat -at
奇怪的是,netstat不会显示具有暴露端口的docker容器,尽管他们正在监听并回复浏览器.
如何netstat显示这些暴露的端口？
更新: 我在Debian 8 Jessie上运行它.这是我做的:
docker ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
9dfa08bab50d workflows-nginx "/bin/sh -c '/usr/sbi" 2 hours ago Up 2 hours 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp workflows-nginx
d0b0c3f90f13 workflows-django "/bin/sh -c 'python /" 7 hours ago Up 3 hours 0.0.0.0:8000->8000/tcp workflows-django
99a857c92533 workflows-db "/docker-entrypoint.s" 7 hours ago Up 3 hours 5432/tcp workflows-db
这里docker报告容器端口被转发到主机.此外,如果我停止workflows-nginx容器,它将停止通过http(端口80)回答浏览器.如果我再次启动它,它会再次开始响应.
这是输出sudo netstat -at | less:
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 *:ssh *:* LISTEN
tcp 0 0 localhost:ipp *:* LISTEN
tcp 0 0 *:15672 *:* LISTEN
tcp 0 0 *:postgresql *:* LISTEN
tcp 0 0 localhost:smtp *:* LISTEN
tcp 0 0 *:25672 *:* LISTEN
tcp 0 0 *:48142 *:* LISTEN
tcp 0 0 *:sunrpc *:* LISTEN
tcp 0 0 *:epmd *:* LISTEN
tcp 0 0 bob-acer:34866 104.16.33.249:http ESTABLISHED
tcp 0 0 bob-acer:42380 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:42543 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:42525 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:44076 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:42944 stackoverflow.com:https ESTABLISHED
tcp 0 0 localhost:epmd localhost:50831 ESTABLISHED
tcp 0 0 bob-acer:42655 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:42384 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:44626 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:42390 stackoverflow.com:https ESTABLISHED
tcp 0 0 localhost:50831 localhost:epmd ESTABLISHED
tcp 0 0 bob-acer:48301 c2.52.c0ad.ip4.st:https ESTABLISHED
tcp 0 0 bob-acer:42151 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:42205 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:42539 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:44737 stackoverflow.com:https ESTABLISHED
tcp 0 0 bob-acer:39648 77.94.164.251:https ESTABLISHED
tcp6 0 0 [::]:ssh [::]:* LISTEN
tcp6 0 0 localhost:ipp [::]:* LISTEN
tcp6 0 0 [::]:postgresql [::]:* LISTEN
tcp6 0 0 localhost:smtp [::]:* LISTEN
tcp6 0 0 [::]:44794 [::]:* LISTEN
tcp6 0 0 [::]:8000 [::]:* LISTEN
tcp6 0 0 [::]:amqp [::]:* LISTEN
tcp6 0 0 [::]:sunrpc [::]:* LISTEN
tcp6 1 0 localhost:58497 localhost:ipp CLOSE_WAIT
如您所见,端口80和端口443均未报告.workflows-django由于某种原因,端口8000 在IPv6接口上打开.此外,我忘了在主机上禁用postgres,但仍然没有与postgres容器发生冲突workflows-db.
一切都在我的本地笔记本上运行,所以我想主机不会有任何混淆.
我的码头版本是:
docker --version
Docker version 1.10.3, build 20f81dd
解答:这与docker EXPOSE参数有关.如果在dockerfile中写入此行并使用-p运行容器,则该端口将在netstat中可见.如果使用-p但不写EXPOSE,则netstat不会列出您的端口.
回答问题永远不会太晚。
使用netstat -tln，不netstat -at。
--numeric如果您通知的选项，回答起来非常简单netstat。通过使用此选项，netstat 将打印带有数字的地址而不是有意义的字符串。然后你可以像你提到的那样grep它们。下面展示了它是如何工作的。
[root@A01-R26-I52-155-3002023 ~]# netstat -tl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 localhost.localdom:smux 0.0.0.0:* LISTEN
tcp 0 0 localhost.localdo:18121 0.0.0.0:* LISTEN
tcp 0 0 localhost.localdo:18122 0.0.0.0:* LISTEN
tcp 0 0 localhost.localdo:18123 0.0.0.0:* LISTEN
tcp 0 0 localhost.localdo:18124 0.0.0.0:* LISTEN
tcp 0 0 localhost.localdo:18125 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:sunrpc 0.0.0.0:* LISTEN
tcp 0 0 localhost.localdo:18928 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:20080 0.0.0.0:* LISTEN
tcp 0 0 A01-R26-:univ-appserver 0.0.0.0:* LISTEN
tcp 0 0 A01-R26-:univ-appserver 0.0.0.0:* LISTEN
tcp 0 0 localhost.:search-agent 0.0.0.0:* LISTEN
tcp 0 0 localhost:mosaicsyssvc1 0.0.0.0:* LISTEN
tcp 0 0 A01-R26-I52-155-300:ssh 0.0.0.0:* LISTEN
tcp6 0 0 [::]:37611 [::]:* LISTEN
tcp6 0 0 [::]:sunrpc [::]:* LISTEN
tcp6 0 0 [::]:microsan [::]:* LISTEN
tcp6 0 0 [::]:commtact-http [::]:* LISTEN
[root@A01-R26-I52-155-3002023 ~]# netstat -tln
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 127.0.0.1:199 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:18121 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:18122 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:18123 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:18124 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:18125 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:18928 0.0.0.0:* LISTEN
tcp 0 0 0.0.0.0:20080 0.0.0.0:* LISTEN
tcp 0 0 10.217.52.155:1233 0.0.0.0:* LISTEN
tcp 0 0 10.218.52.155:1233 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:1234 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:1235 0.0.0.0:* LISTEN
tcp 0 0 10.217.52.155:22 0.0.0.0:* LISTEN
tcp6 0 0 :::37611 :::* LISTEN
tcp6 0 0 :::111 :::* LISTEN
tcp6 0 0 :::20001 :::* LISTEN
tcp6 0 0 :::20002 :::* LISTEN
netstat应该显示暴露的端口。这是一个例子
anovil@anovil-Latitude-E6440:docker$ sudo netstat -at|grep 3030
anovil@anovil-Latitude-E6440:docker$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
anovil@anovil-Latitude-E6440:docker$ docker run -d -p 3030:80 httpd:2.4
4310ac5fbdbc7314ab4d23e34099a710a3a8790dcf2c6d0a84202c1de5c9fd30
anovil@anovil-Latitude-E6440:docker$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4310ac5fbdbc httpd:2.4 "httpd-foreground" 3 minutes ago Up 3 minutes 0.0.0.0:3030->80/tcp hungry_fermat
anovil@anovil-Latitude-E6440:docker$ sudo netstat -at|grep 3030
tcp6 0 0 [::]:3030 [::]:* LISTEN
anovil@anovil-Latitude-E6440:docker$ sudo netstat -tulpn|grep 3030
tcp6 0 0 :::3030 :::* LISTEN 10294/docker-proxy
anovil@anovil-Latitude-E6440:docker$
您需要验证自己的一些基本知识：
docker psdocker ps列出端口转发？像上面一样，您应该可以看到类似这样的内容0.0.0.0:3030->80/tcp另请注意，docker-proxy是在主机上运行的那个。以上所有命令均假定您在Linux上运行。已使用ubuntu 15.10进行了测试
如果您仍然觉得缺少转发，请回发您的操作系统，docker版本等。
谢谢，
此代码将向您显示容器内带有 pid 的打开端口：
container_name=some_container_name
c_pid=`docker container inspect -f "{{.State.Pid}}" ${container_name}`
nsenter -t ${c_pid} -n netstat -anp
| 归档时间： |
|
| 查看次数： |
21154 次 |
| 最近记录： |