docker 網路 不好用 docker: Error response from daemon: failed to create endpoint jovial_wing on network b
阿新 • • 發佈:2019-01-23
啟動容器時,有可能會遇到如下問題,比如啟動redis容器:
sudo docker run -d -p 6379:6379 --name redis redis:latest
Linux程式碼-
docker: Error response from daemon: failed to create endpoint redis on network bridge: iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 10.211.55.9 --dport 6379 -j DNAT --to-destination 172.17
- (exit status 1).
通過分析異常資訊,發現是因為在進行原地址到目標地址轉換的時候沒有在docker主機的iptables規則中找到nat表規則,只有filter表規則。
在filter表上面增加nat表配置規則資訊,需要說明的是docker容器的網段是172.17.0.0/16,另外需要注意filter表中也要有docker鏈的相關配置。
sudo vi /etc/sysconfig/iptables
-
Shell程式碼
-
# sample configuration for iptables service
- # you can edit this manually or use system-config-firewall
- # please do not ask us to add additional ports/services to this default configuration
- *nat
- :PREROUTING ACCEPT [27:11935]
- :INPUT ACCEPT [0:0]
- :OUTPUT ACCEPT [0:0]
- :POSTROUTING ACCEPT [0:0]
- :DOCKER -[0:0]
-
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
- -A OUTPUT !-d 127.0.0.0/8-m addrtype --dst-type LOCAL -j DOCKER
- -A POSTROUTING -s 172.17.0.0/16!-o docker0 -j MASQUERADE
- COMMIT
- #
- *filter
- :INPUT ACCEPT [0:0]
- :FORWARD ACCEPT [0:0]
- :OUTPUT ACCEPT [0:0]
- :DOCKER -[0:0]
- -A FORWARD -o docker0 -j DOCKER
- -A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
- -A FORWARD -i docker0 !-o docker0 -j ACCEPT
- -A FORWARD -i docker0 -o docker0 -j ACCEPT
- -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
- -A INPUT -p icmp -j ACCEPT
- -A INPUT -i lo -j ACCEPT
- -A INPUT -p tcp -m state --state NEW -m tcp --dport 22-j ACCEPT
- -A INPUT -p tcp -m state --state NEW -m tcp --dport 9090-j ACCEPT
- -A INPUT -p tcp -m state --state NEW -m tcp --dport 1521-j ACCEPT
- -A INPUT -p tcp -m state --state NEW -m tcp --dport 6379-j ACCEPT
- -A INPUT -j REJECT --reject-with icmp-host-prohibited
- -A FORWARD -j REJECT --reject-with icmp-host-prohibited
- COMMIT
-
# sample configuration for iptables service
重啟iptables
sudo systemctl restart iptables.service
重新啟動容器即可。