Can't reach a Docker container's port from another machine

Likely causes

1. The port was never published (no -p), so no DNAT rule exists.
2. The rule sends the port to the wrong container address, where nothing listens.
3. The service in the container listens on 127.0.0.1 only.

Diagnose

Run these in order. The output is what each printed on a lab's real Linux machines.

colleague:~# curl -sS -m 3 http://10.0.1.10:8080/

From another machine the host's port 8080 is refused: nothing on the host listens there.

curl: (7) Failed to connect to 10.0.1.10 port 8080 after 0 ms: Could not connect to server

Fix

laptop:~# iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80

Send the host's port 8080 to the container's port 80, as docker run -p 8080:80 does.

laptop:~# iptables -t nat -S PREROUTING
-P PREROUTING ACCEPT
-A PREROUTING -j NETLAB-PREROUTING
-A PREROUTING -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.17.0.2:80

colleague:~# curl -s -m 3 http://10.0.1.10:8080/

The colleague gets the container's page through the host.

hello from the web container

iptables -t nat -D PREROUTING -p tcp --dport 8080 -j DNAT --to-destination 172.17.0.3:80

A rule to the wrong container must go first: the first matching rule wins. Check with iptables -t nat -S PREROUTING.

The fix the lab's challenge "Port 8080 opens the wrong container" checks.

Break it and fix it yourself

Each lab is a small network of real Linux machines in your browser, where this fault happens.

• Container networking: namespaces, veth and a bridge Free: its challenge "Port 8080 opens the wrong container" set the fault for you to find and fix.

Open Container networking: namespaces, veth and a bridge