2
  • I'm having a docker image based on rabbitmq.

  • Nothing in my Dockerfile specifies anything about ports.

  • I bind the usual rabbitmq ports (5671, 5672 and 15672) to my custom ports by running my instance as follows:

    docker run -d -p $someport:5671 -p 127.0.0.1::5672 -p $somemgtport:15672 myimage

  • There is nothing in my iptables INPUT chain, and the FORWARD chain is filled with the usual docker stuff.

The problem

When $somemgtport is different from 15672 I can't access to it (the rabbitmq management interface via HTTP) from the outside world.

But it seems that I used the -p flag correctly because curl https://localhost:$somemgtport works as expected (as well as the amqp calls to $someport).

When running, the iptables DOCKER chain is the following:

Chain DOCKER (1 references)
 target     prot opt in     out     source               destination
 ACCEPT     tcp  --  !docker0 docker0  anywhere             xyz  tcp dpt:15672
 ACCEPT     tcp  --  !docker0 docker0  anywhere             xyz  tcp dpt:5671
 ACCEPT     tcp  --  !docker0 docker0  anywhere             xyz  tcp dpt:amqp

So it doesn't open the ports $someport and $somemgtport but rather the ports that are correspond to the "inside" of the container: 5671 and 15672 (the ones from rabbitmq).

=> it seems to me that it's doing exactly the contrary to what I would expect...!

What did I do wrong with the docker run command?

NB: I want other ports than the default ones because I'm running 2 instances of rabbitmq on the same machine.


Update - Here's a partial output of netstat -pln (with someport=55001 and somemgtport=65002):

tcp6       0      0 :::55001                :::*                    LISTEN      29613/docker-proxy
tcp6       0      0 :::65002                :::*                    LISTEN      29622/docker-proxy

netstat -pln | grep 15672 has no output

1
  • Can you share the output of netstat -pln | grep 15672 inside the container? – ronnix Feb 27 '15 at 16:02
1

Deprecation Notice: That question is outdated, whatever might have created it at the time doesn't exist anymore. Docker stopped using iptables (to achieve port redirection) a long time ago, the network layer was rewritten from scratch at least twice since the question was posted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.