主机在Docker容器内无法访问

Question

我在主机上183.83.83.83 有一个docker 容器。子域mycontainer.example.com的A记录指向此IP。

卷曲183.83.83.83或mycontainer.example.com给出HTTP状态200和正确的网站。

但是，从该主机上的每个容器内部（到上述IP或主机名）相同的卷曲无法连接：

curl: (7) Failed to connect to mycontainer.example.com port 80: Host is unreachable

从另一个主机的Docker容器或主机本身尝试此操作时，不会发生这种情况。

这是怎么了？

编辑：更多详细信息：主机运行一个Nginx代理容器，该容器将所有请求代理mycontainer.example.com到我的前端容器（通过小节点Web服务器运行React应用程序）。前端容器应该代理从mycontainer.example.com/api发出的所有API请求mycontainer.example.com:1337/api/v1。但是它不能代理API请求，因为我Host is unreachable从此主机上运行的所有容器内部收到错误。

Answer 1

使用 FirewallD 的最新方法是执行以下命令：

firewall-cmd --permanent --zone=trusted --change-interface=docker0
firewall-cmd --reload

Answer 2

I know it is an old question but for anybody coming here, the solution, at least on Linux, is to allow incoming network packets to host from docker bridge network by modifying the iptables of the host as following:

sudo iptables -I INPUT -i docker0 -j ACCEPT

It translates to accept all incoming network packets on host from docker bridge network (assuming it is docker0) i.e. traffic from docker containers.

Here are the details:

-I INPUT means to insert a netfilter rule for incoming packets to host
-i docker0 means packets from docker0 interface of the host
-j ACCEPT means accept all packets since a protocol is not defined it implies that packets of any protocol are welcome.

Refer to iptables --help and netfilter website for more details.