Docker-nginx: Port 80 and Port 443 not accessible when published via `ports`

[ian-axelrod]

Hi,

I've been trying unsuccessfully to redirect calls to http://localhost and https://localhost to a docker container by using nginx listening on port 80 and 443 inside its own docker container, with ports published via docker-compose.yml, i.e:

        image: nginx:alpine
        ports:
            - 127.0.0.1:80:80
            - 127.0.0.1:443:443

I cannot get this to work. I get connection refused. When I change the ports (on the host) to anything else (441, 81, 8443, 8080, ...), everything works just fine. I'm not positive this is an nginx issue, but considering nginx image exposes port 80/443, I was wondering if there is some conflict.

I've checked to see that port 80 and 443 are not in use, and they aren't, except for docker itself because of the above docker-compose.yml config. I've also checked pf filter rules -- nothing in there that would forward traffic on port 80/443 to some other ip:port.

Any ideas?

ETA:

I'm on macOS Sierra. I'm using docker 1.12.5, docker-compose 1.9.0, docker-machine 0.8.2.

[nsteinmetz]

Are you sure your container is running?

From the doc, ports section is not well written:

ports:
 - "3000"
 - "3000-3005"
 - "8000:8000"
 - "9090-9091:8080-8081"
 - "49100:22"
 - "127.0.0.1:8001:8001"
 - "127.0.0.1:5000-5010:5000-5010"

Quotes are missing.

[ian-axelrod]

Yes, I'm sure.

9b906f5a1422  nginx:alpine  "nginx -g 'daemon off" 18 minutes ago  Up 18 minutes 127.0.0.1:80->80/tcp, 127.0.0.1:443->443/tcp composer_web_1

Forgot to say I'm on docker for mac, so no virtualbox / docker-machine.

Also, I've tried having it listen on 0.0.0.0 instead of localhost. That didn't help.

[thresheek]

Check the IP address of your docker virtual machine. It should be opening the ports on that one, not your laptop's own ip address.

[ian-axelrod]

I don't have a docker VM though. I'm using docker for mac, so it's using hyper, not vbox. That's why I can connect via localhost to any other port, just not to 80/443.

[thresheek]

docker for mac still runs a linux virtual machine using xhyve to launch docker daemon on.

[ian-axelrod]

Still no dice.

[ian-axelrod]

This is driving me crazy.

I went as far as tcpdumping the interface, but the log doesn't really help. basically there's an initial burst of traffic to localhost:http and some randomly allocated port, but then silence. With port 81 (xfer), there's that same burst of traffic, but then a flurry of new requests between localhost:xfer and a few randomly assigned ports (sockets). Basically tcp handshakes then sequence increments. Happens with safari, too. Makes me think there's something in the kernel itself that is causing this, or something else very low level even though system logs suggest nothing is amiss.

This is very frustrating.

It appears to happen for /any/ docker container that has a service listening on port 80 (host), not only nginx, so I suppose that this ticket should be transferred to docker for mac.

[nsteinmetz]

Some NAT or Forwarding issue on docker for mac (never used it, I'm on linux) ?

As it's <1024 port, maybe some root/rights issue too ?

[ian-axelrod]

I considered the <1024 port issue, but port 81 works just fine, as does port 444. It's only port 80 and port 443 that give me trouble.

[iilei]

same situation here with

docker-machine version 0.10.0
docker-compose version 1.11.2
Docker version 17.03.1-ce

[andreif]

@ian-axelrod Just to be sure, you did try:

        ports:
            - 0.0.0.0:80:80
            - 0.0.0.0:443:443

correct? This works for me.

[nooperpudd]

Still the sample connection refused in the production settings.
docker version : Docker version 17.06.0-ce, build 02c1d87
nginx: nginx/1.11.12

[thresheek]

Works fine here:

thresh@fruity ~/tmp/dock $ cat docker-compose.yml
version: '3'
services:
    web:
        image: nginx:alpine
        ports:
            - 127.0.0.1:80:80
            - 127.0.0.1:443:443
thresh@fruity ~/tmp/dock $ docker-compose up
Creating network "dock_default" with the default driver
Pulling web (nginx:alpine)...
alpine: Pulling from library/nginx
128191993b8a: Pull complete
655cae3ea06e: Pull complete
dbc72c3fd216: Pull complete
f391a4589e37: Pull complete
Digest: sha256:34aa80bb22c79235d466ccbbfa3659ff815100ed21eddb1543c6847292010c4d
Status: Downloaded newer image for nginx:alpine
Creating dock_web_1 ...
Creating dock_web_1 ... done
Attaching to dock_web_1
web_1  | 172.18.0.1 - - [21/Dec/2017:11:03:57 +0000] "HEAD / HTTP/1.0" 200 0 "-" "-" "-"

(while in the other terminal):

thresh@fruity ~ $ telnet 127.0.0.1 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
HEAD / HTTP/1.0

HTTP/1.1 200 OK
Server: nginx/1.13.7
Date: Thu, 21 Dec 2017 11:03:57 GMT
Content-Type: text/html
Content-Length: 612
Last-Modified: Fri, 01 Dec 2017 21:45:50 GMT
Connection: close
ETag: "5a21cd8e-264"
Accept-Ranges: bytes

Connection closed by foreign host.

Versions:

thresh@fruity ~ $ docker --version
Docker version 17.09.1-ce, build 19e2cf6
thresh@fruity ~ $ docker-compose --version
docker-compose version 1.17.1, build 6d101fb
thresh@fruity ~ $ docker-machine --version
docker-machine version 0.13.0, build 9ba6da9

[rishiloyola]

Nope it's not working for me.

[Bellafkb]

same here.

[ovikholt]

This is might be because of a different problem. See https://serverfault.com/questions/742364/port-80-connection-refused-how-to-fix-on-mac-osx. It's super old though, but the answer worked for me

[sebagr]

@ovikholt thank you! This pointed me in the right direction.

My problem was pfctl (which I didn't know existed at all) was enabled and redirecting all traffic on port 80 to 8080, and port 443 to 8443, without reporting any process listening on those ports. However, they were kind of "reserved", so even if I bound some process to those ports it wouldn't work because pfctl would redirect the traffic before it hit the actual port.

The solution for me was easy: just publish the ports to 8080 and 8443. I can now make requests to port 80 and 443 and they get redirected transparently to 8080 and 8443.

    image: nginx:alpine
    ports:
        - 127.0.0.1:8080:80
        - 127.0.0.1:8443:443

Not sure why I had pfctl enabled in the first place. Maybe it has something to do with me running the builtin Apache on Mac a long time ago. I'm not sure if I can get rid of it altogether so I opted for a more conservative solution. I hope this saves somebody some hours of debugging.