无法连接到在本地 Docker 容器中运行的 Go GRPC 服务器 [英] Cannot connect to Go GRPC server running in local Docker container

问题描述

我有一个 go grpc 服务.我正在 mac 上开发，sierra.在本地针对服务运行 grpc 客户端时，一切正常，但是在 docker 容器中针对同一服务运行相同客户端时，出现此错误:

I have a go grpc service. I'm developing on a mac, sierra. When running a grpc client against the service locally, all is well, but when running same client against same service in the docker container I get this error:

transport: http2Client.notifyError got notified that the client transport was broken EOF.
FATA[0000] rpc error: code = Internal desc = transport is closing

这是我的 docker 文件:

this is my docker file:

FROM golang:1.7.5

RUN mkdir -p /go/src/github.com/foo/bar
WORKDIR /go/src/github.com/foo/bar

COPY . /go/src/github.com/foo/bar
# ONBUILD RUN go-wrapper download
RUN go install

ENTRYPOINT /go/bin/bar

EXPOSE 51672

我构建镜像的命令:

docker build -t bar .

我用来启动 docker 容器的命令:

my command to launch the docker container:

docker run -p 51672:51672 --name bar-container bar

其他信息:

• 客户端程序在 docker 容器内运行良好
• 连接到常规的休息端点工作正常(http2，grpc 相关?)

• 在 OS X 中运行 lsof 命令会产生这些结果

  $lsof -i | grep 51672
  com.docke   984 oldDave   21u  IPv4 0x72779547e3a32c89      0t0  TCP *:51672 (LISTEN)
  com.docke   984 oldDave   22u  IPv6 0x72779547cc0fd161      0t0  TCP localhost:51672 (LISTEN)
  

• 这是我的服务器代码片段:

• here's a snippet of my server code:

  server := &Server{}
  endpoint := "localhost:51672"
  lis, err := net.Listen("tcp", endpoint)
  if err != nil {
      log.Fatalf("failed to listen: %v", err)
  }
  
  s := grpc.NewServer(grpc.Creds(creds))
  
  pb.RegisterExpServiceServer(s, server)
  
  // Register reflection service on gRPC server.
  reflection.Register(s)
  
  log.Info("Starting Exp server: ", endpoint)
  
  if err := s.Serve(lis); err != nil {
      log.Fatalf("failed to serve: %v", err)
  }
  

推荐答案

当您指定要侦听的主机名或 IP 地址(在本例中为解析为 127.0.0.1 的 localhost)时，您的服务器将仅侦听该IP地址.

When you specify a hostname or IP address​ to listen on (in this case localhost which resolves to 127.0.0.1), then your server will only listen on that IP address.

当您在 Docker 容器之外时，在 localhost 上侦听不是问题.如果您的服务器只侦听 127.0.0.1:51672，那么您的客户端可以轻松连接到它，因为连接也是从 127.0.0.1 建立的.

Listening on localhost isn't a problem when you are outside of a Docker container. If your server only listens on 127.0.0.1:51672, then your client can easily connect to it since the connection is also made from 127.0.0.1.

当您在 Docker 容器中运行服务器时，它只会像以前一样侦听 127.0.0.1:51672.127.0.0.1 是本地环回地址，在容器外无法访问.

When you run your server inside a Docker container, it'll only listen on 127.0.0.1:51672 as before. The 127.0.0.1 is a local loopback address and it not accessible outside the container.

当您使用-p 51672:51672"启动 docker 容器时，它会将前往 127.0.0.1:51672 的流量转发到容器的 IP 地址，在我的情况下为 172.17.0.2.

When you fire up the docker container with "-p 51672:51672", it'll forward traffic heading to 127.0.0.1:51672 to the container's IP address, which in my case is 172.17.0.2.

容器在 docker0 网络接口中获取 IP 地址(您可以使用ip addr ls"命令查看)

The container gets an IP addresses within the docker0 network interface (which you can see with the "ip addr ls" command)

因此，当您的流量被转发到 172.17.0.2:51672 上的容器时，那里没有任何监听，连接尝试失败.

So, when your traffic gets forwarded to the container on 172.17.0.2:51672, there's nothing listening there and the connection attempt fails.

修复:

问题在于监听端点:

endpoint := "localhost:51672"

要解决您的问题，请将其更改为

To fix your problem, change it to

endpoint := ":51672"

这将使您的服务器侦听所有容器的 IP 地址.

That'll make your server listen on all it container's IP addresses.

附加信息:

当您在 Docker 容器中公开端口时，Docker 将创建 iptables 规则来执行实际转发.请参阅此.您可以查看这些规则与:

When you expose ports in a Docker container, Docker will create iptables rules to do the actual forwarding. See this. You can view these rules with:

iptables -n -L 
iptables -t nat -n -L

这篇关于无法连接到在本地 Docker 容器中运行的 Go GRPC 服务器的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！