0

I have tried all the possible solutions available on either StackOverflow or other forums, that I could find. I begin installing redis with docker by actual instructions available on Hub Docker. But I was not able to connect to Redis outside container.

My initial command:

docker run --name c-redis -d redis

After further searching I found that I needed to execute it as:

docker run --name mag-redis -d redis -p 6379:6379

But this failed as well, as I got the following error.

$ docker run --name c-redis -d redis -p 6379:6379 
c2dbf68f52b46e90671a7efaafbe46898368bb"
Unable to find image 'redis:latest' locally
latest: Pulling from library/redis
8559a31e96f4: Already exists
85a6a5c53ff0: Already exists
b69876b7abed: Already exists
a72d84b9df6a: Already exists
5ce7b314b19c: Already exists
04c4bfb0b023: Already exists
Digest: sha256:800f2587bf3376cb01e6307afe599ddce9439deafbd4fb8562829da96085c9c5
Status: Downloaded newer image for redis:latest
075d68ec71abf3752050c947e44a4b1c52305fb6153febe815e31659284612cf
docker: Error response from daemon: driver failed programming external connectivity on endpoint c-redis (f251e744aeacbd1a084f11b0e01731b1e1a36454ca8ad634889dd38dae66314d):  (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 6379 -j DNAT --to-destination 172.17.0.3:6379 ! -i docker0: iptables: No chain/target/match by that name.
 (exit status 1)).

I then restarted iptables as one of the solutions available online was this. But this did not help, and same error again. I then found another query on Stackoverflow i.e.

docker run --name c-redis -p 6379:6379 -d redis --restart unless-stopped -v /etc/redis/:/data --appendonly yes --requirepass "password"

However, same error of iptables... I then removed the image/container, and executed with first command (docker run --name c-redis -d redis), it redis was installed but again I was not able to access to externally (by the same host, outside container).

I again removed the container/image, and tried those other 2 commands, but each time I was having same iptables error, I even tried to reboot the docker. Still no use.

I am using Centos 7. Please let me know if anyone else faced such issue. I am totally stuck here for the past several hour(s).

docker: Error response from daemon: driver failed programming external connectivity on endpoint c-redis (f251e744aeacbd1a084f11b0e01731b1e1a36454ca8ad634889dd38dae66314d): (iptables failed: iptables --wait -t nat -A DOCKER -p tcp -d 0/0 --dport 6379 -j DNAT --to-destination 172.17.0.3:6379 ! -i docker0: iptables: No chain/target/match by that name. (exit status 1)).

EDIT:

Docker version:

Client: Docker Engine - Community
 Version:           19.03.12
 API version:       1.40
 Go version:        go1.13.10
 Git commit:        48a66213fe
 Built:             Mon Jun 22 15:46:54 2020
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          19.03.12
  API version:      1.40 (minimum version 1.12)
  Go version:       go1.13.10
  Git commit:       48a66213fe
  Built:            Mon Jun 22 15:45:28 2020
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.2.13
  GitCommit:        7ad184331fa3e55e52b890ea95e65ba581ae3429
 runc:
  Version:          1.0.0-rc10
  GitCommit:        dc9208a3303feef5b3839f4323d9beb36df0a9dd
 docker-init:
  Version:          0.18.0
  GitCommit:        fec3683

UPDATE: (Iptables -S; iptables -t nat -S)

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-N f2b-postfix
-N f2b-postfix-sasl
-A INPUT -p tcp -m multiport --dports 25,587 -j f2b-postfix
-A INPUT -p tcp -m multiport --dports 25,587,953 -j f2b-postfix-sasl
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 31337 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,443,587,25,53 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 80 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
-A f2b-postfix -s 212.70.149.18/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix -j RETURN
-A f2b-postfix-sasl -s 212.70.149.18/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -j RETURN
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT

Thank you!

Improve this question
4
  • Are you using firewalld or did you replace it with something else?
    – Michael Hampton
    Jul 4, 2020 at 18:38
  • No I am using iptables, and docker is able to add rules for discourse in iptables.
    – nix
    Jul 4, 2020 at 18:40
  • OK, please post a copy of your running firewall: iptables -S; iptables -t nat -S
    – Michael Hampton
    Jul 4, 2020 at 18:41
  • I have updated with iptables rules. Also, i did reinstall iptables 3 days ago. and those docker rules were from previously saved file. Just realising is it because of reinstallation?
    – nix
    Jul 4, 2020 at 18:46

1 Answer 1

Reset to default
1

You probably should just have used firewalld instead of trying to write a manual firewall. It looks like you deleted the DOCKER chain from the nat table, that Docker creates when it starts up. You can re-create this chain and Docker should be able to start writing rules to it again.

iptables -t nat -N DOCKER

But there are probably other rules missing, and so you should just restart Docker and let it fix everything.

Improve this answer
4
  • I restarted docker, and I see the iptables -t nat -S shows different rules now. However, my discourse... I can't start it. Error response from daemon: failed to listen to abstract unix socket "/containerd-shim/moby/614ec8660fe2e8b2ec3e43e0a3bf57a0a05e977c4828c0f3162cc7ea7a682fab/shim.sock": listen unix /containerd-shim/moby/614ec8660fe2e8b2ec3e43e0a3bf57a0a05e977c4828c0f3162cc7ea7a682fab/shim.sock: bind: address already in use: unknown I tried to stop docker and start still same error.
    – nix
    Jul 4, 2020 at 19:01
  • 1
    Sounds like that container was already running and Docker tried to start it again. Your system is really in a messed up state. I suggest you just reboot.
    – Michael Hampton
    Jul 4, 2020 at 19:02
  • following command was executed successfully, docker run -d --name redis -p 6379:6379 --restart unless-stopped -v /etc/redis/:/data redis redis-server /data --appendonly yes --requirepass "password"
    – nix
    Jul 4, 2020 at 19:35
  • one last question, now is there a package/module like redis-tools, where I can only use the redis-cli on host to access redis.
    – nix
    Jul 4, 2020 at 19:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .