啟動容器時,有可能會遇到如下問題,比如啟動redis容器:
sudo docker run -d -p 6379:6379 --name redis redis:latest
- docker:?Error?response?from?daemon:?failed?to?create?endpoint?redis?on?network?bridge:?iptables?failed:?iptables?--wait?-t?nat?-A?DOCKER?-p?tcp?-d?10.211.55.9?--dport?6379?-j?DNAT?--to-destination?172.17.0.4:6379?!?-i?docker0:?iptables:?No?chain/target/match?by?that?name.??
- ?(exit?status?1).??
?
通過分析異常信息,發現是因為在進行原地址到目標地址轉換的時候沒有在docker主機的iptables規則中找到nat表規則,只有filter表規則。
?
在filter表上面增加nat表配置規則信息,需要說明的是docker容器的網段是172.17.0.0/16,另外需要注意filter表中也要有docker鏈的相關配置。
sudo?vi /etc/sysconfig/iptables
-
- #?sample?configuration?for?iptables?service??
- #?you?can?edit?this?manually?or?use?system-config-firewall??
- #?please?do?not?ask?us?to?add?additional?ports/services?to?this?default?configuration??
- *nat??
- :PREROUTING?ACCEPT?[27:11935]??
- :INPUT?ACCEPT?[0:0]??
- :OUTPUT?ACCEPT?[0:0]??
- :POSTROUTING?ACCEPT?[0:0]??
- :DOCKER?-[0:0]??
- -A?PREROUTING?-m?addrtype?--dst-type?LOCAL?-j?DOCKER??
- -A?OUTPUT?!-d?127.0.0.0/8-m?addrtype?--dst-type?LOCAL?-j?DOCKER??
- -A?POSTROUTING?-s?172.17.0.0/16!-o?docker0?-j?MASQUERADE??
- COMMIT??
- #??
- *filter??
- :INPUT?ACCEPT?[0:0]??
- :FORWARD?ACCEPT?[0:0]??
- :OUTPUT?ACCEPT?[0:0]??
- :DOCKER?-[0:0]??
- -A?FORWARD?-o?docker0?-j?DOCKER??
- -A?FORWARD?-o?docker0?-m?conntrack?--ctstate?RELATED,ESTABLISHED?-j?ACCEPT??
- -A?FORWARD?-i?docker0?!-o?docker0?-j?ACCEPT??
- -A?FORWARD?-i?docker0?-o?docker0?-j?ACCEPT??
- -A?INPUT?-m?state?--state?RELATED,ESTABLISHED?-j?ACCEPT??
- -A?INPUT?-p?icmp?-j?ACCEPT??
- -A?INPUT?-i?lo?-j?ACCEPT??
- -A?INPUT?-p?tcp?-m?state?--state?NEW?-m?tcp?--dport?22-j?ACCEPT??
- -A?INPUT?-p?tcp?-m?state?--state?NEW?-m?tcp?--dport?9090-j?ACCEPT??
- -A?INPUT?-p?tcp?-m?state?--state?NEW?-m?tcp?--dport?1521-j?ACCEPT??
- -A?INPUT?-p?tcp?-m?state?--state?NEW?-m?tcp?--dport?6379-j?ACCEPT??
- -A?INPUT?-j?REJECT?--reject-with?icmp-host-prohibited??
- -A?FORWARD?-j?REJECT?--reject-with?icmp-host-prohibited??
- COMMIT??
重啟iptables
sudo systemctl restart iptables.service?
?
重新啟動容器即可。