8WSEV0.jpg

工作中遇到个问题，需要在运行中的docker容器中增加端口映射，此文档做个笔记

修改iptables端口映射

docker的端口映射并不是在docker技术中实现的，而是通过宿主机的iptables来实现。通过控制网桥来做端口映射，类似路由器中设置路由端口映射。

查看iptables设置的规则

1

iptables -t nat -vnL

查看对应的docker的规则。可以查看到对应端口的容器ip信息

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

Chain DOCKER (2 references)
 pkts bytes target     prot opt in     out     source               destination
  143  8580 RETURN     all  --  docker0 *       0.0.0.0/0            0.0.0.0/0
   37  2140 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:9000 to:172.17.0.2:9000
   16   880 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8090 to:172.17.0.3:8082
    5   220 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8085 to:172.17.0.3:8085
    5   220 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8084 to:172.17.0.3:8084
    5   220 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8083 to:172.17.0.3:8083
   23  1324 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8081 to:172.17.0.3:8081
    4   176 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:50000 to:172.17.0.6:50000
......

也可以通过inspect命令查看容器ip

1

docker inspect 容器名或id |grep IPAddress

增加端口映射

1

iptables -t nat -A DOCKER -p tcp --dport 10800 -j DNAT --to-destination 172.17.0.3:10080

查看规则

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

$ iptables -t nat -vnL DOCKER --line-number
...
7       23  1324 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:8081 to:172.17.0.3:8081
8        4   176 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:50000 to:172.17.0.6:50000
9        1    52 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:37900 to:172.17.0.6:37900
10       2   128 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10082 to:172.17.0.11:80
11       0     0 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10088 to:172.17.0.12:1080
12       0     0 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:18888 to:172.17.0.13:8080
13      10   640 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:18889 to:172.17.0.13:80
14     160  9612 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3306 to:172.17.0.14:3306
15     479 28740 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10080 to:172.17.0.10:1080
16       2   128 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:20081 to:172.17.0.15:1080
17      16  1024 DNAT       tcp  --  !docker0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:20080 to:172.17.0.15:80
18       0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:10800 to:172.17.0.3:10080

如果加错了可以对应删除规则

1

iptables -t nat -D DOCKER 18