express - 为什么我的代理 docker 网络请求在本地工作而不是在生产中工作?
问题描述
我正在开发一个为私有/安全 docker 注册表构建前端的项目。我这样做的方式是使用 docker-compose 在前端和注册表之间创建一个网络。我的想法是使用 express 为我的站点提供服务,并通过 docker 网络将来自客户端的请求转发到注册表。
在本地,一切都很完美......
但是,在生产中,客户端不会从注册表中得到响应。我可以登录到注册表并通过邮递员(例如目录)访问它的 api https://myregistry.net:5000/v2/_catalog
。但是......客户端只是出错了。
当我进入快速服务器容器并尝试将我创建的端点卷曲到代理请求时,我得到了这个
curl -vvv http://localhost:3000/api/images
* Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 3000 (#0)
> GET /api/images HTTP/1.1
> Host: localhost:3000
> User-Agent: curl/7.61.1
> Accept: */*
>
* Empty reply from server
* Connection #0 to host localhost left intact
curl: (52) Empty reply from server
并且返回的错误_currentUrl
包括https://username:password@registry:5000/v2/_catalog
我的 docker-compose 文件看起来像这样......
version: '3'
services:
registry:
image: registry:2
container_name: registry
ports:
# forward requests to registry.ucdev.net:5000 to 127.0.0.1:443 on the container
- "5000:443"
environment:
REGISTRY_AUTH: htpasswd
REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
REGISTRY_HTTP_ADDR: 0.0.0.0:443
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/fullchain.pem
REGISTRY_HTTP_TLS_KEY: /certs/privkey.pem
volumes:
- /etc/letsencrypt/live/registry.ucdev.net/fullchain.pem:/certs/fullchain.pem
- /etc/letsencrypt/live/registry.ucdev.net/privkey.pem:/certs/privkey.pem
- ./auth:/auth
restart: always
server:
image: uc/express
container_name: registry-server
ports:
- "3000:3000"
volumes:
- ./:/project
environment:
NODE_ENV: production
restart: always
entrypoint: ["npm", "run", "production"]
我的前端请求的示例如下所示...
axios.get('http://localhost:3000/api/images')
.then((response) => {
const { data: { registry, repositories } } = response;
this.setState((state, props) => {
return { registry, repositories }
})
})
.catch((err) => {
console.log(`Axios error -> ${err}`)
console.error(err)
})
并且该请求被发送到快速服务器,然后像这样发送到注册表......
app.get('/api/images', async (req, res) => {
// scheme is either http or https depending on NODE_ENV
// registry is the name of the container on the docker network
await axios.get(`${scheme}://registry:5000/v2/_catalog`)
.then((response) => {
const { data } = response;
data.registry = registry;
res.json(data);
})
.catch((err) => {
console.log('Axios error -> images ', err);
return err;
})
})
你能提供的任何帮助都会很棒!谢谢!
解决方案
在这种特殊情况下,这是与服务器后面的防火墙有关的问题。来自 docker 容器的请求被阻止。为了解决这个问题,我们必须明确设置network_mode
to bridge。这允许来自容器内的请求正确运行。最终的 docker-compose 文件看起来像这样
version: '3'
services:
registry:
image: registry:2
container_name: registry
# setting network_mode here and on the server helps the express api calls work correctly on the myregistry.net server.
# otherwise, the calls fail with 'network unreachable' due to the firewall.
network_mode: bridge
ports:
# forward requests to myregistry.net:5000 to 127.0.0.1:443 on the container
- "5000:443"
environment:
REGISTRY_AUTH: htpasswd
REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
REGISTRY_AUTH_HTPASSWD_REALM: Registry Realm
REGISTRY_HTTP_ADDR: 0.0.0.0:443
REGISTRY_HTTP_TLS_CERTIFICATE: /certs/fullchain.pem
REGISTRY_HTTP_TLS_KEY: /certs/privkey.pem
volumes:
- /etc/letsencrypt/live/myregistry.net/fullchain.pem:/certs/fullchain.pem
- /etc/letsencrypt/live/myregistry.net/privkey.pem:/certs/privkey.pem
- ./auth:/auth
restart: always
server:
image: uc/express
container_name: registry-server
network_mode: bridge
ports:
- "3000:3000"
volumes:
- ./:/project
environment:
NODE_ENV: production
restart: always
entrypoint: ["npm", "run", "production"]
推荐阅读
- python - 不懂 scipy.optimize.brute 语法
- python - 全局列表未全局化
- shell - 设置视图时如何添加要执行的命令?
- typescript - 如何处理带有可选泛型参数的函数重载?
- java - 使用 JAVA 将字符串拆分为多个部分并存储到 CSV
- angular - 如何每1小时在页面中刷新数据,而当标签接收到焦点时
- php - 在 PHP Autoload 中添加快捷方式会导致 Laravel 发生冲突
- php - Symfony3中生成实体时出错如何解决
- c - 如何通知工作线程有一些工作要完成?
- java - 如何将 javafx 中 TextArea 的 isUndoable 属性设置为 true?