使用Docker时,已建立的连接不会出现在netstat中 [英] When using Docker, ESTABLISHED connections don't appear in netstat
问题描述
我有一个运行在带有Docker 1.7.0的RHEL 7上的Docker容器。在此容器中运行的程序侦听端口5000上的TCP连接。
在我的Dockerfile中,输入句子EXPOSE 5000,然后使用以下命令运行容器:
I have a docker container running on RHEL 7 with Docker 1.7.0. The program which running in this container listens for TCP connections on port 5000. In my Dockerfile I put the sentence EXPOSE 5000 and I run the container with the following command:
docker run \
--name myProgram \
--detach \
--publish 5000:5000 \
--volume /home/docker/apps/myProgram/logs:/var/log/myProgram/ \
--volume /home/docker/apps/myProgram/conf:/usr/local/snnotificationreceiver/conf/ \
--restart always \
10.167.152.15:5000/myProgram:1.0.0
当我在主机上执行netstat时,我看到LISTEN套接字:
When I execute netstat on the host I see the LISTEN socket:
[root@server bin]# netstat -naop | grep 5000
tcp6 0 0 :::5000 :::* LISTEN 33595/docker-proxy off (0.00/0/0)
我可以通过连接到端口5000上的主机IP地址来连接到应用程序,然后我发送到应用程序的数据就到达了。我知道这一点是因为我在应用程序日志中看到了它,该应用程序还通过套接字发送数据。但是我在码头主机上看不到使用netstat建立的连接:
I can connect to the application by connecting to the host ip address on port 5000 and the data I send to the application arrives. I know this because I see it on my application logs, the application also sends data through the socket. However I don't see any ESTABLISHED connections using netstat on the docker host:
[root@server bin]# netstat -naop | grep ESTABLISHED
我看到客户端上已建立的连接不使用docker:
I see the ESTABLISHED connection on the client side which doesn't use docker:
[root@client ~]# netstat -naop | grep 5000
tcp 0 0 10.167.43.73:39218 10.167.152.138:5000 ESTABLISHED 21429/telnet off (0.00/0/0)
我没有找到与netstat
等价或类似的docker命令,这正常吗?我如何看到与容器或docker-proxy建立的连接?
I didn't find any docker command equivalent or similar to netstat Is this normal? How can I see the ESTABLISHED connections to a container or to the docker-proxy?
谢谢
推荐答案
您可以执行以下操作:
docker exec <containerid> netstat -tan | grep ESTABLISHED
,或者如果您的docker映像中没有netstat:
or if you don't have netstat in your docker image:
docker inspect -f '{{.State.Pid}}' <containerid> # note the PID
sudo nsenter -t <pid> -n netstat | grep ESTABLISHED
nsenter是util-linux软件包的一部分。
(pla窃@larsks)
nsenter is part of util-linux package. (plagiarized @larsks)
这篇关于使用Docker时,已建立的连接不会出现在netstat中的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!